CVE-2024-7990: Open WebUI Stored XSS Vulnerability in open-webui Package
Summary
CVE-2024-7990: Open WebUI stored cross-site scripting (XSS) vulnerability. Affects open-webui versions < 0.3.8. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The open-webui package is a Python-based web interface designed to facilitate user interactions with various models and data. It allows users to create, manage, and visualize models through a user-friendly interface. However, the package has a critical vulnerability that affects its security, particularly in how it handles user input in the model description field.
Vulnerability Detail
A stored cross-site scripting (XSS) vulnerability exists in the open-webui package version 0.3.8. This vulnerability is found in the '/api/v1/models/add' endpoint, where the model description field is not properly sanitized before being rendered in chat. This oversight allows attackers to inject malicious scripts that can be executed by any user, including administrators. The potential ramifications include unauthorized access, data manipulation, and arbitrary code execution, posing a significant risk to the integrity and security of the application.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can implement input validation and sanitization on the model description field before rendering it in the chat. This can be done by using libraries such as 'bleach' to clean the input. Example code:
import bleach
def sanitize_input(user_input):
return bleach.clean(user_input)
model_description = sanitize_input(input('Enter model description: '))
Conclusion
The open-webui package has a critical stored XSS vulnerability that can lead to severe security risks. Users are strongly advised to update to a patched version to protect their applications from potential attacks. Implementing input validation can also serve as a temporary measure until the update is applied.
See every vulnerability recorded for open-webui →
FAQ
A stored XSS vulnerability allows an attacker to inject malicious scripts into a web application, which are then stored on the server and executed when other users access the affected content.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to use the Vulert playground without signup.
The consequences can include unauthorized access to user accounts, data theft, and the potential for attackers to execute arbitrary code on the server.
Yes, a patch is available. Users should upgrade to a version of open-webui later than 0.3.8 to mitigate the vulnerability.
The CVSS score of this vulnerability is 8.4, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for open-webui.
