CVE-2024-7034: Open WebUI Arbitrary File Write Vulnerability
Summary
CVE-2024-7034: Open WebUI Allows Arbitrary File Write via the /models/upload Endpoint. Affects open-webui versions < 0.3.8. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Open WebUI is a web-based user interface designed to facilitate interactions with various models and data. It allows users to upload files and manage data efficiently. However, in version 0.3.8, it has a critical vulnerability that exposes the system to arbitrary file write attacks, compromising the integrity and security of the application.
Vulnerability Detail
In open-webui version 0.3.8, the endpoint '/models/upload' is vulnerable to arbitrary file write due to improper handling of user-supplied filenames. The vulnerability arises from the usage of 'file_path = f"{UPLOAD_DIR}/{file.filename}"' without proper input validation or sanitization. An attacker can exploit this by manipulating the 'file.filename' parameter to include directory traversal sequences, causing the resulting 'file_path' to escape the intended 'UPLOAD_DIR' and potentially overwrite arbitrary files on the system. This can lead to unauthorized modifications of system binaries, configuration files, or sensitive data, potentially enabling remote command execution.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can implement input validation and sanitization on the 'file.filename' parameter to prevent directory traversal attacks. For example, you can restrict the allowed characters in the filename and ensure it does not contain any '../' sequences.
Conclusion
The Open WebUI vulnerability (CVE-2024-7034) poses a significant risk due to its potential for arbitrary file writes. Users are urged to update to a patched version to mitigate this risk and implement necessary input validation as a temporary workaround.
See every vulnerability recorded for open-webui →
FAQ
The vulnerability allows attackers to overwrite arbitrary files on the system, which can lead to unauthorized modifications of critical files and potential remote command execution.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The affected version is 0.3.8. Any version prior to the patch release is also vulnerable.
If you cannot update the package, implement input validation and sanitization as a temporary measure to mitigate the risk of exploitation.
The CVSS score of this vulnerability is 6.5, indicating a medium severity level.
Related vulnerabilities
Recent vulnerabilities recorded for open-webui.
