Attack Chain

1. An attacker authenticates to the Open-WebUI instance with an account that has model creation permissions (workspace.models).
2. The attacker crafts a malicious model description containing a markdown link with a javascript: URI (e.g., [text](javascript:alert())).
3. The attacker uses the /api/v1/models/create endpoint to create a new model with the malicious description.
4. The Open-WebUI application stores the unsanitized model description in the database.
5. A victim user (including an administrator) navigates to the chat UI and views the model with the malicious description.
6. The application retrieves the model description from the database and renders it using sanitizeResponseContent, replaceAll('\n', '<br>'), marked.parse(), and {@html ...}.
7. The marked.parse() function converts the markdown link into an <a href="javascript:..."> HTML element.
8. The victim user clicks on the malicious link, triggering the execution of the JavaScript code within their browser. This could exfiltrate the user's access token via a crafted javascript: url.

Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary JavaScript code within the context of a victim's browser. This can lead to a variety of malicious outcomes, including session hijacking, theft of sensitive information (such as access tokens), defacement of the user interface, and potentially, remote code execution if combined with other vulnerabilities. Given the ability to steal admin tokens, attackers can create new tools to execute arbitrary code, which impacts all Open-WebUI users.

Recommendation

• Upgrade Open-WebUI to version v0.9.0 or later, where the output of marked.parse() is wrapped with DOMPurify.sanitize() to mitigate the XSS vulnerability.
• Deploy the Sigma rule "Detect Open-WebUI Model Creation with Javascript URI" to identify attempts to create models with malicious descriptions.
• Review existing model descriptions for suspicious content, particularly markdown links with javascript: URIs, and remove or sanitize any identified malicious entries.