PT-2025-12175 · Unknown · Open-Webui

Published 2025-03-20 · Updated 2025-03-21 · CVE-2024-7035

Positive Technologies (AI Summary)

CVSS v3.1

6.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:H/A:L

Name of the Vulnerable Software and Affected Versions open-webui/open-webui version v0.3.8

Description The issue allows an attacker to perform Cross-Site Request Forgery (CSRF) attacks. This can happen when an unaware user visits a malicious site or through top-level navigation, causing them to unintentionally perform sensitive actions. The affected endpoints include "/rag/api/v1/reset", "/rag/api/v1/reset/db", "/api/v1/memories/reset", and "/rag/api/v1/reset/uploads". This impacts both the availability and integrity of the application.

Recommendations For version v0.3.8, consider disabling or restricting access to the sensitive endpoints "/rag/api/v1/reset", "/rag/api/v1/reset/db", "/api/v1/memories/reset", and "/rag/api/v1/reset/uploads" until a patch is available. Avoid using the GET method for sensitive actions such as deleting and resetting. As a temporary workaround, restrict the use of sensitive actions to POST methods or other more secure methods to minimize the risk of exploitation.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2024-7035

GHSA-P5VX-9HJ8-CF4H

Affected Products

Open-Webui

References · 6

• 🔥 https://huntr.com/bounties/2ac81740-410b-467a-9244-75d82a6f9e11 · Exploit
• https://osv.dev/vulnerability/GHSA-p5vx-9hj8-cf4h · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-7035 · Security Note
• https://osv.dev/vulnerability/CVE-2024-7035 · Vendor Advisory
• https://github.com/open-webui/open-webui · Note
• https://twitter.com/CVEnew/status/1902968844878291334 · Twitter Post