CVE-2024-8053: Open WebUI PDF Endpoint Lacks Authentication Leading to Potential DoS
Summary
CVE-2024-8053: Open WebUI lacks authentication for the api/v1/utils/pdf endpoint. Affects open-webui versions < 0.3.10. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Open WebUI is an open-source web application that provides a user interface for various utilities, including PDF generation. It is designed to facilitate easy access to web-based functionalities. However, the application has a critical vulnerability in version v0.3.10, where the PDF generation endpoint lacks proper authentication, exposing it to unauthorized access and potential abuse.
Vulnerability Detail
In version v0.3.10 of open-webui/open-webui, the 'api/v1/utils/pdf' endpoint is vulnerable due to the absence of authentication mechanisms. This allows unauthenticated attackers to exploit the PDF generation service by sending a POST request with a large payload, which can lead to server resource exhaustion and denial of service (DoS). Furthermore, unauthorized users can misuse this endpoint to generate PDFs without any verification, resulting in operational and financial impacts.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can implement a reverse proxy or API gateway that requires authentication before allowing access to the 'api/v1/utils/pdf' endpoint. This can help mitigate unauthorized access until the package is updated.
Conclusion
The Open WebUI vulnerability CVE-2024-8053 poses significant risks due to the lack of authentication on the PDF generation endpoint. It is crucial for users to update to the patched version and consider implementing workarounds to mitigate potential threats.
See every vulnerability recorded for open-webui →
FAQ
CVE-2024-8053 is a vulnerability in the Open WebUI package where the PDF generation endpoint lacks authentication, allowing unauthorized access.
The vulnerability can lead to denial of service (DoS) due to resource exhaustion and unauthorized PDF generation, which can have operational and financial consequences.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
You can update the package by running the command 'pip install --upgrade open-webui' in your terminal.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for open-webui.
