PT-2024-3607 · Unknown · Open-Webui

Sylwia-Budzynska · Published 2024-03-18 · Updated 2025-06-30 · CVE-2024-30256

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Open WebUI versions prior to 0.1.117

Description: The issue is related to an authenticated blind server-side request forgery vulnerability. It involves the download file stream() function in the backend/apps/web/routers/utils.py file of the Open WebUI, which is exploited through the url parameter. This allows a remote attacker to perform an SSRF attack.

Recommendations: For versions prior to 0.1.117, update to version 0.1.117 to resolve the issue. As a temporary workaround, consider restricting access to the download file stream() function until the update is applied. Avoid using the url parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

BDU:2024-03923

CVE-2024-30256

GHSA-39WR-R5VM-3JXJ

Affected Products

Open-Webui

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/30xxx/CVE-2024-30256.json · Exploit
• 🔥 https://securitylab.github.com/advisories/GHSL-2024-033_open-webui · Exploit
• https://github.com/open-webui/open-webui/security/advisories/GHSA-39wr-r5vm-3jxj · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-03923 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-30256 · Security Note
• https://osv.dev/vulnerability/CVE-2024-30256 · Vendor Advisory
• https://t.me/cvenotify/77071 · Telegram Post
• https://twitter.com/GHSecurityLab/status/1781012819858571733 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1780273938846597147 · Twitter Post
• https://t.me/cvenotify/127111 · Telegram Post
• https://vuldb.com/pl/?id.260946 · Note