CVE-2024-12537: Open-webui Uncontrolled Resource Consumption Vulnerability
Summary
CVE-2024-12537: Open WebUI Uncontrolled Resource Consumption vulnerability. Affects open-webui versions < 0.3.32. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Open-webui is an open-source web user interface framework designed to facilitate the development of web applications. It provides a set of tools and components that enable developers to create interactive and responsive user interfaces. However, in version 0.3.32, it lacks proper authentication mechanisms, making it susceptible to unauthorized access and potential abuse.
Vulnerability Detail
The vulnerability arises from the absence of authentication for the api/v1/utils/code/format endpoint in open-webui version 0.3.32. This allows any unauthenticated attacker to send a POST request with a large volume of content, which can overwhelm the server. As a result, the server may become unresponsive or experience significant performance degradation, leading to service interruptions for legitimate users. The CVSS score for this vulnerability is 7.5, indicating a high severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can implement rate limiting on the server to restrict the number of requests from a single IP address. This can help mitigate the impact of potential abuse until a proper fix is applied.
Conclusion
In summary, CVE-2024-12537 is a significant vulnerability in open-webui that can lead to severe performance issues due to uncontrolled resource consumption. It is crucial to update to a patched version and consider implementing rate limiting as a temporary measure to protect your application.
See every vulnerability recorded for open-webui →
FAQ
CVE-2024-12537 is a vulnerability in open-webui that allows unauthorized access to a specific API endpoint, leading to potential server overload.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor for open-source vulnerabilities without any signup.
The consequences include server unresponsiveness and performance degradation, which can disrupt service for legitimate users.
Yes, updating to a version of open-webui higher than 0.3.32 will provide a patch for this vulnerability.
Vulert monitors and alerts for open-source vulnerabilities in software using just the Pipfile.lock. It provides real-time alerts without requiring access to the code or installation.
Related vulnerabilities
Recent vulnerabilities recorded for open-webui.
