CVE-2024-7036
📋 TL;DR
An unauthenticated attacker can cause denial-of-service by submitting excessively large text in the 'name' field during signup, making the Admin panel unresponsive and preventing user management. Authenticated low-privilege users can also trigger this. All open-webui v0.3.8 deployments are affected.
💻 Affected Systems
- open-webui/open-webui
📦 What is this software?
Open Webui by Openwebui
⚠️ Risk & Real-World Impact
Worst Case
Complete loss of administrative functionality, preventing user management and potentially requiring service restart or database cleanup to restore operations.
Likely Case
Temporary denial-of-service affecting the Admin panel, requiring manual intervention to remove the malicious user entry.
If Mitigated
Minimal impact with proper input validation and rate limiting in place.
🎯 Exploit Status
Simple text input manipulation with no special tools required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v0.3.9 or later
Vendor Advisory: https://github.com/open-webui/open-webui/security/advisories
Restart Required: No
Instructions:
1. Update open-webui to v0.3.9 or later using your package manager or deployment method. 2. Verify the update completed successfully. 3. No restart required for web applications.
🔧 Temporary Workarounds
Input Validation Filter
allImplement server-side validation to limit 'name' field length before processing.
# Add validation in user registration endpoint
# Example: if len(name) > 100: return error
Temporary Signup Disable
allDisable new user signups until patched.
# Disable signup endpoint in web server config
# Example: location /api/signup { deny all; }
🧯 If You Can't Patch
- Implement WAF rules to block requests with excessively long 'name' parameters.
- Monitor Admin panel responsiveness and have manual cleanup procedures ready.
🔍 How to Verify
Check if Vulnerable:
Check if running open-webui v0.3.8 by examining version in package.json or deployment configuration.Check Version:
grep version package.json or check docker image tagVerify Fix Applied:
Confirm version is v0.3.9 or later and test that large 'name' inputs are properly rejected.📡 Detection & Monitoring
Log Indicators:
- Unusually long 'name' parameter values in signup requests
- Admin panel error logs showing timeouts or memory issues
Network Indicators:
- HTTP POST requests to signup endpoint with large payloads
SIEM Query:
source="web_logs" AND uri_path="/api/signup" AND request_size>1000