Denial of Service (DoS) in open-webui/open-webui

Vulnerability

Overview

CVE-2024-12534 identifies a denial-of-service vulnerability in open-webui version 0.3.32. The sign-in process lacks character length validation on the email and password fields, allowing an attacker to submit excessively large strings that consume server CPU, memory, and disk space [1][2].

Attack

Vector

The vulnerability is exploitable over the network without authentication, as the sign-in endpoint is publicly accessible. An attacker can craft HTTP requests containing oversized email or password values, causing the server to allocate disproportionate resources while handling the input [3]. The attack requires no special privileges, making the server susceptible to resource exhaustion from any network-accessible client [2].

Impact

Successful exploitation leads to a denial-of-service condition, where legitimate users are unable to access the service due to exhausted resources. The impact is limited to availability; no data confidentiality or integrity is compromised [2].

Mitigation

As of the advisory, a fix is not included in version 0.3.32. Users should monitor the open-webui repository for patched releases. No workaround is documented; limiting network access to trusted IPs may reduce exposure but does not eliminate the vulnerability [1][4].