Unauthenticated Denial of Service in open-webui/open-webui

Vulnerability

Overview In open-webui version 0.3.32, the api/v1/utils/code/format endpoint lacks any authentication mechanism, allowing unauthenticated attackers to send POST requests to this endpoint [1][2]. The endpoint's implementation does not limit the size of the request body, making it susceptible to resource exhaustion [3].

Exploitation

An attacker can exploit this vulnerability by sending a POST request with an excessively large payload (e.g., a very large string or JSON blob) to the unauthenticated endpoint. No prior authentication or network position is required; the attack can be carried out over the internet if the server is exposed [2][4]. The server may become completely unresponsive while processing the large payload, leading to denial of service.

Impact

Successful exploitation can render the server unresponsive, causing severe performance degradation or complete service interruption for legitimate users [2]. This is a high-severity denial-of-service vulnerability that can be triggered remotely without any credentials.

Mitigation

The open-webui project has not yet released a patched version as of this analysis [1]. Administrators are advised to restrict access to the endpoint via a reverse proxy or firewall, or implement authentication for the api/v1/utils/code/format endpoint as a workaround.