PT-2024-38040 · Unknown · Open-Webui

Published 2024-10-09 · Updated 2024-11-03 · CVE-2024-7038

Positive Technologies (AI Summary)

CVSS v3.1

2.7

Low

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions open-webui version 0.3.8

Description An information disclosure issue exists related to the embedding model update feature under admin settings. When a user updates the model path, the system checks if the file exists and provides different error messages based on the existence and configuration of the file. This behavior allows an attacker to enumerate file names and traverse directories by observing the error messages, leading to potential exposure of sensitive information.

Recommendations For open-webui version 0.3.8, consider restricting access to the admin settings and the embedding model update feature until a patch is available. As a temporary workaround, consider modifying the error messages to be more generic, preventing attackers from enumerating file names and traversing directories.

Exploit

Fix

Generation of Error Message Containing Sensitive Information

Information Disclosure

Weakness Enumeration

CWE-209

CWE-200

Related Identifiers

CVE-2024-7038

GHSA-MQ92-JR35-FFPC

Affected Products

Open-Webui

References · 9

• 🔥 https://huntr.com/bounties/f42cf72a-8015-44a6-81a9-c6332ef05afc · Exploit
• https://osv.dev/vulnerability/CVE-2024-7038 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mq92-jr35-ffpc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-7038 · Security Note
• https://github.com/open-webui/open-webui · Note
• https://github.com/open-webui/open-webui/blob/eff736acd2e0bbbdd0eeca4cc209b216a1f23b6a/backend/apps/rag/main.py#L199 · Note
• https://t.me/cvedetector/7524 · Telegram Post
• https://twitter.com/CVEnew/status/1844086631680160144 · Twitter Post
• https://t.me/cvenotify/98172 · Telegram Post