Description (CNA)
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.11.0, Open WebUI resolved a hostname during URL validation and rejected private, loopback, and link-local addresses, but the HTTP clients resolved the hostname again at connection time. An authenticated attacker who controlled authoritative DNS for a submitted hostname could answer with a public address during validation and an internal one during connection, reaching cloud metadata, loopback admin APIs, or internal services through URL ingest, chat image_url fetches, image editing, or OAuth profile-picture fetches, with most paths returning the response to the attacker and the OAuth path forwarding the OAuth access token. This issue is fixed in 0.11.0.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| open-webui / open-webui | affected < 0.11.0 |
CWE
CWE-367, CWE-918
References
- https://github.com/open-webui/open-webui/security/advisories/GHSA-h6x2-583h-x99r
- https://github.com/open-webui/open-webui/releases/tag/v0.11.0
ADP enrichment
No English description supplied.
No references supplied.