CVE-2024-7035: open-webui open-webui/open-webui Cross-Site Request Forgery (CSRF)

Vulnerability summary

CVE-2024-7035 is a medium (CVSS 6.9) Cross-Site Request Forgery (CSRF) vulnerability in open-webui open-webui/open-webui. EPSS estimates a 8.46% chance of exploitation in the next 30 days, higher than 94.9% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 20-03-2025
   PublishedVulnerability first disclosed.
2. 20-03-2025
   Last modifiedVulnerability information updated.

Description

In version v0.3.8 of open-webui/open-webui, sensitive actions such as deleting and resetting are performed using the GET method. This vulnerability allows an attacker to perform Cross-Site Request Forgery (CSRF) attacks, where an unaware user can unintentionally perform sensitive actions by simply visiting a malicious site or through top-level navigation. The affected endpoints include /rag/api/v1/reset, /rag/api/v1/reset/db, /api/v1/memories/reset, and /rag/api/v1/reset/uploads. This impacts both the availability and integrity of the application.

• CWE-352Cross-Site Request Forgery (CSRF)The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.