CVE-2024-7049
📋 TL;DR
This vulnerability allows users with pending roles to obtain authentication tokens and perform unauthorized actions without admin approval. It affects open-webui installations running version v0.3.8, potentially allowing unapproved users to access privileged functionality.
💻 Affected Systems
- open-webui
📦 What is this software?
Open Webui by Openwebui
⚠️ Risk & Real-World Impact
Worst Case
An attacker could create a pending user account, obtain a token, and gain unauthorized access to administrative functions or sensitive data within the web UI.
Likely Case
Pending users accidentally or intentionally bypass the approval workflow and access features they shouldn't have access to yet.
If Mitigated
With proper role-based access controls and monitoring, impact is limited to temporary unauthorized access until detected.
🎯 Exploit Status
Exploitation requires creating or having a pending user account. The vulnerability is straightforward to exploit once a pending account exists.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v0.3.9 or later
Vendor Advisory: https://huntr.com/bounties/ee9e3532-8ef1-4599-bb59-b8e2ba43a1fc
Restart Required: Yes
Instructions:
1. Update open-webui to version v0.3.9 or later. 2. Restart the open-webui service. 3. Verify the update was successful.
🔧 Temporary Workarounds
Disable pending user registration
allTemporarily disable new user registration or pending role assignments until patched.
# Configure open-webui to disable new user registration in settings
Monitor pending user logins
allImplement logging and alerting for any login attempts by users with pending roles.
# Configure audit logging for user authentication events
🧯 If You Can't Patch
- Implement strict monitoring of user activity logs for any actions by pending users
- Manually review and approve/reject all pending users immediately to eliminate the attack surface
🔍 How to Verify
Check if Vulnerable:
Check if running open-webui version v0.3.8. Attempt to login with a pending user account and check if a token is returned.Check Version:
Check the open-webui version in the web interface or configuration filesVerify Fix Applied:
After updating to v0.3.9+, verify that pending users cannot obtain authentication tokens or access the system.📡 Detection & Monitoring
Log Indicators:
- Successful login by users with 'pending' role
- Authentication token generation for pending users
- API calls or actions performed by pending users
Network Indicators:
- Authentication requests from unapproved user accounts
- API calls with tokens from pending users
SIEM Query:
source="open-webui" AND (event="login_success" AND user_role="pending") OR (event="token_generated" AND user_status="pending")