CVE-2024-8053

In version v0.3.10 of open-webui/open-webui, the `api/v1/utils/pdf` endpoint lacks authentication mechanisms, allowing unauthenticated attackers to access the PDF generation service. This vulnerability can be exploited by sending a POST request with an excessively large payload, potentially leading to server resource exhaustion and denial of service (DoS). Additionally, unauthorized users can misuse the endpoint to generate PDFs without verification, resulting in service misuse and potential operational and financial impacts.

CVSS v3 8.2 HIGH

8.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://huntr.com/bounties/ebe8c1fa-113b-4df9-be03-a406b9adb9f4	Exploit Third Party Advisory
https://huntr.com/bounties/ebe8c1fa-113b-4df9-be03-a406b9adb9f4	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:openwebui:open_webui:0.3.10:*:*:*:*:*:*:*

History

No history.

Information

Published : 2025-03-20 10:15

Updated : 2025-03-27 11:15

NVD link : CVE-2024-8053

Mitre link : CVE-2024-8053

CVE.ORG link : CVE-2024-8053

JSON object : View

Products Affected

openwebui

open_webui

CWE

CWE-306

Missing Authentication for Critical Function

{"id": "CVE-2024-8053", "cveTags": [], "metrics": {"cvssMetricV30": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV31": [{"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.2, "exploitabilityScore": 3.9}]}, "published": "2025-03-20T10:15:39.993", "references": [{"url": "https://huntr.com/bounties/ebe8c1fa-113b-4df9-be03-a406b9adb9f4", "tags": ["Exploit", "Third Party Advisory"], "source": "[email protected]"}, {"url": "https://huntr.com/bounties/ebe8c1fa-113b-4df9-be03-a406b9adb9f4", "tags": ["Exploit", "Third Party Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-306"}]}, {"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-306"}]}], "descriptions": [{"lang": "en", "value": "In version v0.3.10 of open-webui/open-webui, the `api/v1/utils/pdf` endpoint lacks authentication mechanisms, allowing unauthenticated attackers to access the PDF generation service. This vulnerability can be exploited by sending a POST request with an excessively large payload, potentially leading to server resource exhaustion and denial of service (DoS). Additionally, unauthorized users can misuse the endpoint to generate PDFs without verification, resulting in service misuse and potential operational and financial impacts."}, {"lang": "es", "value": "En la versi\u00f3n v0.3.10 de open-webui/open-webui, el endpoint `api/v1/utils/pdf` carece de mecanismos de autenticaci\u00f3n, lo que permite a atacantes no autenticados acceder al servicio de generaci\u00f3n de PDF. Esta vulnerabilidad puede explotarse enviando una solicitud POST con una carga excesiva, lo que podr\u00eda provocar el agotamiento de los recursos del servidor y una denegaci\u00f3n de servicio (DoS). Adem\u00e1s, usuarios no autorizados pueden usar indebidamente el endpoint para generar PDF sin verificaci\u00f3n, lo que resulta en un uso indebido del servicio y posibles impactos operativos y financieros."}], "lastModified": "2025-03-27T11:15:36.737", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openwebui:open_webui:0.3.10:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "29BD3977-F33C-4BD9-80A5-0D176D4176CE"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}