PT-2025-12138 · Unknown · Open-Webui

Published 2025-03-20 · Updated 2025-04-04 · CVE-2024-12537

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions open-webui/open-webui version 0.3.32

Description The absence of authentication mechanisms in open-webui/open-webui allows any unauthenticated attacker to access the api/v1/utils/code/format endpoint. If a malicious actor sends a POST request with an excessively high volume of content, the server could become completely unresponsive, leading to severe performance issues and service interruptions for legitimate users.

Recommendations For version 0.3.32, consider disabling access to the api/v1/utils/code/format endpoint until a patch is available. Restricting the volume of content allowed in POST requests to this endpoint can also help mitigate the issue. As a temporary workaround, limiting the resources allocated to handling requests to this endpoint can prevent the server from becoming completely unresponsive.

Exploit

Fix

Resource Exhaustion

Allocation of Resources Without Limits

Weakness Enumeration

CWE-400

CWE-770

Related Identifiers

CVE-2024-12537

GHSA-CHF7-Q7M5-FQ92

Affected Products

Open-Webui

References · 10

• 🔥 https://huntr.com/bounties/edabd06c-acc0-428c-a481-271f333755bc · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-12537 · Security Note
• https://osv.dev/vulnerability/GHSA-chf7-q7m5-fq92 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-12537 · Vendor Advisory
• https://github.com/open-webui/open-webui · Note
• https://github.com/open-webui/open-webui/blob/e8babe62bc8e466be0367703fd062a981f5c2394/src/lib/apis/utils/index.ts#L25-L56 · Note
• https://t.me/cvenotify/117716 · Telegram Post
• https://twitter.com/AyushInfo57268/status/1908095559312769362 · Twitter Post
• https://twitter.com/CVEnew/status/1903027706674946352 · Twitter Post
• https://twitter.com/SecurtyRating/status/1908094898928005368 · Twitter Post