Session Fixation in open-webui/open-webui

Vulnerability

Overview

CVE-2024-7053 describes a session fixation vulnerability in open-webui version 0.3.8 [2]. The root cause is that the application sets session cookies with SameSite=Lax and without the Secure flag. This configuration allows session cookies to be sent over HTTP to a cross-origin domain, enabling a session fixation attack [2].

Attack

Vector

An attacker with a standard user-level account can exploit this by embedding a crafted markdown image in a chat message [2]. When an administrator views the message, the image request triggers the transmission of the administrator's session cookie to an attacker-controlled server [2]. The attack requires no special privileges beyond a basic user account, making it widely exploitable within the platform.

Impact

Successful exploitation leads to a stealthy administrator account takeover [2]. By hijacking the admin's session, the attacker gains elevated privileges, which could be chained to achieve remote code execution (RCE) [2]. The official description highlights that the impact is significant due to the high level of access associated with administrator accounts.

Mitigation

The vulnerability affects open-webui version 0.3.8 [2]. The vendor has been notified, and users should update to a patched version as soon as it becomes available. No workaround is described, but administrators should monitor for unexpected session behavior until a fix is applied [1][3].