CVE-2024-12537
📋 TL;DR
This vulnerability in open-webui version 0.3.32 allows unauthenticated attackers to send large POST requests to the /api/v1/utils/code/format endpoint, causing server resource exhaustion and denial of service. Any system running the vulnerable version without authentication controls is affected, potentially leading to complete service unavailability.
💻 Affected Systems
- open-webui/open-webui
📦 What is this software?
Open Webui by Openwebui
⚠️ Risk & Real-World Impact
Worst Case
Complete server unresponsiveness leading to extended service outage, requiring manual intervention to restore functionality.
Likely Case
Significant performance degradation causing intermittent service interruptions for legitimate users.
If Mitigated
Minimal impact with proper authentication and rate limiting in place.
🎯 Exploit Status
Exploitation requires only sending large POST requests to the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 0.3.33 or later
Vendor Advisory: https://huntr.com/bounties/edabd06c-acc0-428c-a481-271f333755bc
Restart Required: Yes
Instructions:
1. Update open-webui to version 0.3.33 or later using package manager. 2. Restart the open-webui service. 3. Verify the update was successful.
🔧 Temporary Workarounds
Implement authentication
allAdd authentication middleware to protect the vulnerable endpoint
Rate limiting
allImplement request rate limiting on the /api/v1/utils/code/format endpoint
🧯 If You Can't Patch
- Implement network-level access controls to restrict access to the vulnerable endpoint
- Deploy a web application firewall (WAF) with request size limiting rules
🔍 How to Verify
Check if Vulnerable:
Check if running open-webui version 0.3.32 and if /api/v1/utils/code/format endpoint is accessible without authentication.Check Version:
Check package.json or run: npm list open-webuiVerify Fix Applied:
Verify version is 0.3.33 or later and test that the endpoint now requires authentication or rejects large requests.📡 Detection & Monitoring
Log Indicators:
- Large POST requests to /api/v1/utils/code/format
- High memory/CPU usage spikes
- Server error logs indicating resource exhaustion
Network Indicators:
- Unusually large HTTP POST requests to the vulnerable endpoint
- Multiple rapid requests from single IP
SIEM Query:
source="webui.logs" AND (uri="/api/v1/utils/code/format" AND request_size>1000000) OR (error="resource exhaustion")