PT-2025-12183 · Unknown · Open-Webui

Published 2025-03-20 · Updated 2025-04-07 · CVE-2024-7053

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions open-webui/open-webui version 0.3.8

Description A vulnerability allows an attacker with a user-level account to perform a session fixation attack. The session cookie for all users is set with the default SameSite=Lax and does not have the Secure flag enabled, allowing the session cookie to be sent over HTTP to a cross-origin domain. An attacker can exploit this by embedding a malicious markdown image in a chat, which, when viewed by an administrator, sends the admin's session cookie to the attacker's server. This can lead to a stealthy administrator account takeover, potentially resulting in remote code execution (RCE) due to the elevated privileges of administrator accounts.

Recommendations For open-webui/open-webui version 0.3.8, consider updating the session cookie settings to include the Secure flag and set SameSite to a more restrictive value, such as Strict, to prevent session fixation attacks. As a temporary workaround, restrict access to administrator accounts and avoid viewing potentially malicious content from untrusted sources.

Exploit

Fix

RCE

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-7053

GHSA-43G4-487M-5Q6M

Affected Products

Open-Webui

References · 7

• 🔥 https://huntr.com/bounties/947f8191-0abf-4adf-b7c4-d4c19683aba2 · Exploit
• https://osv.dev/vulnerability/GHSA-43g4-487m-5q6m · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-7053 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-7053 · Security Note
• https://github.com/open-webui/open-webui · Note
• https://twitter.com/CVEnew/status/1902671001227600154 · Twitter Post
• https://twitter.com/Hossted_OSS/status/1909096436593025407 · Twitter Post