CVE-2024-7036: Open WebUI Uncontrolled Resource Consumption Vulnerability
Summary
CVE-2024-7036: Open WebUI Uncontrolled Resource Consumption vulnerability. Affects open-webui versions < 0.3.8. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Open WebUI is a web-based user interface framework designed for building interactive applications. It allows developers to create user-friendly interfaces with various features such as user management, data visualization, and real-time updates. However, the framework is susceptible to vulnerabilities that can compromise its functionality and user experience.
Vulnerability Detail
A vulnerability in open-webui version 0.3.8 allows an unauthenticated attacker to exploit the 'name' field during user signup by submitting excessively large text. This leads to uncontrolled resource consumption, causing the Admin panel to become unresponsive. As a result, administrators are unable to perform critical user management tasks, including deleting, editing, or adding users. Additionally, authenticated users with low privileges can also trigger this vulnerability, resulting in the same adverse effects on the Admin panel.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can implement input validation on the 'name' field to restrict the length of user input. For example, you can limit the character count in your signup form as follows:
if len(name) > MAX_LENGTH:
raise ValueError('Name is too long')
Conclusion
In summary, CVE-2024-7036 is a significant vulnerability in the open-webui package that can lead to resource exhaustion in the Admin panel. It is crucial to update to a patched version to mitigate the risk and ensure smooth user management operations.
See every vulnerability recorded for open-webui →
FAQ
CVE-2024-7036 is a vulnerability in the open-webui package that allows attackers to cause resource exhaustion in the Admin panel.
Both unauthenticated attackers and authenticated users with low privileges can exploit this vulnerability.
The vulnerability can render the Admin panel unresponsive, preventing administrators from managing users effectively.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for open-webui.
