""Open WebUI stores the JWT token in localStorage," Cato researchers said in a blog post. "Any script running on the page can access it. Tokens are long-lived by default, lack HttpOnly, and are cross-tab. When combined with the execute event, this creates a window for account takeover." The attack requires the victim to enable Direct Connections (disabled by default) and add the attacker's malicious model URL, according to an NVD description."
"Escalating to Remote Code Execution The risk doesn't stop at account takeover. If the compromised account has workspace.tools permissions, attackers can leverage that session token to push authenticated Python code through Open WebUI's Tools API, which executes without sandboxing or validation. This turns a browser-level compromise into full remote code execution on the backend server. Once an attacker gets Python execution, they can install persistence mechanisms, pivot into internal networks, access sensitive data stores, or run lateral attacks."
"The flaw received a high severity rating at 8/10 base score by NVD, and a 7.3/10 base score by GitHub. The flaw was rated high rather than critical, reflecting the fact that exploitation requires the Direct Connections feature to be enabled and hinges on a user first being lured into connecting to a malicious external model server. Patch mitigation in Open WebUI v0.6.35 involves blocking "execute" SSE events from Direct Connections entirely, but any organization still on older builds remains exposed."
Open WebUI stores JWT tokens in localStorage, making them accessible to any script on the page; tokens are long-lived by default, not HttpOnly, and shared across tabs. The Direct Connections feature, if enabled and pointed to a malicious external model URL, allows attacker-controlled execute events to use those tokens, creating an account takeover window. If a compromised account has workspace.tools permissions, attackers can push authenticated Python code through the Tools API, which runs without sandboxing or validation, enabling full remote code execution on the backend. Mitigations include blocking execute SSE events, using short-lived HttpOnly cookies with rotation, enforcing a strict CSP, and banning dynamic code evaluation.
Read at InfoWorld
Unable to calculate read time
Collection
[
|
...
]