CVE-2024-8053: open-webui open-webui/open-webui

Vulnerability summary

CVE-2024-8053 is a high (CVSS 8.2) vulnerability in open-webui open-webui/open-webui. EPSS estimates a 0.65% chance of exploitation in the next 30 days, higher than 50.3% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 20-03-2025
   PublishedVulnerability first disclosed.
2. 27-03-2025
   Last modifiedVulnerability information updated.

Description

In version v0.3.10 of open-webui/open-webui, the `api/v1/utils/pdf` endpoint lacks authentication mechanisms, allowing unauthenticated attackers to access the PDF generation service. This vulnerability can be exploited by sending a POST request with an excessively large payload, potentially leading to server resource exhaustion and denial of service (DoS). Additionally, unauthorized users can misuse the endpoint to generate PDFs without verification, resulting in service misuse and potential operational and financial impacts.

• CWE-306Missing Authentication for Critical FunctionThe product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.