Open-WebUI Stored XSS Vulnerability via Model Description

Open-WebUI versions v0.3.5 through v0.8.12 are susceptible to a stored cross-site scripting (XSS) vulnerability. This flaw allows authenticated users with model creation permissions to inject malicious JavaScript code into the model description field. When other users, including administrators, view the affected model's description in the chat UI and click the specially crafted markdown link, the injected JavaScript code executes within their browsers. This can lead to session hijacking, sensitive data theft, or other unauthorized actions. The vulnerability stems from insufficient sanitization of user-supplied model descriptions before rendering them in the user interface. The issue is resolved in version v0.9.0. This vulnerability is distinct from CVE-2024-7990, as it leverages a different bypass mechanism involving markdown links with javascript: URIs.

Attack Chain

1. An attacker authenticates to the Open-WebUI instance with an account that has model creation permissions (workspace.models).
2. The attacker crafts a malicious model description containing a markdown link with a javascript: URI (e.g., [text](javascript:alert())).
3. The attacker uses the /api/v1/models/create endpoint to create a new model with the malicious description.
4. The Open-WebUI application stores the unsanitized model description in the database.
5. A victim user (including an administrator) navigates to the chat UI and views the model with the malicious description.
6. The application retrieves the model description from the database and renders it using sanitizeResponseContent, replaceAll('\n', '<br>'), marked.parse(), and {@html ...}.
7. The marked.parse() function converts the markdown link into an <a href="javascript:..."> HTML element.
8. The victim user clicks on the malicious link, triggering the execution of the JavaScript code within their browser. This could exfiltrate the user's access token via a crafted javascript: url.

Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary JavaScript code within the context of a victim's browser. This can lead to a variety of malicious outcomes, including session hijacking, theft of sensitive information (such as access tokens), defacement of the user interface, and potentially, remote code execution if combined with other vulnerabilities. Given the ability to steal admin tokens, attackers can create new tools to execute arbitrary code, which impacts all Open-WebUI users.

Recommendation

• Upgrade Open-WebUI to version v0.9.0 or later, where the output of marked.parse() is wrapped with DOMPurify.sanitize() to mitigate the XSS vulnerability.
• Deploy the Sigma rule "Detect Open-WebUI Model Creation with Javascript URI" to identify attempts to create models with malicious descriptions.
• Review existing model descriptions for suspicious content, particularly markdown links with javascript: URIs, and remove or sanitize any identified malicious entries.