CVE-2024-7037
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
Summary
In version v0.3.8 of open-webui/open-webui, the endpoint /api/pipelines/upload is vulnerable to arbitrary file write and delete due to unsanitized file.filename concatenation with CACHE_DIR. This vulnerability allows attackers to overwrite and delete system files, potentially leading to remote code execution.
Impact
This vulnerability can have severe impacts on the affected system. Attackers can exploit this flaw to: 1. Overwrite critical system files, potentially compromising the integrity of the entire system. 2. Delete important files, leading to system instability or data loss. 3. Potentially achieve remote code execution, giving them full control over the affected server. These attacks could result in unauthorized access, data theft, system downtime, or use of the compromised server for further malicious activities.
Exploitation
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Patch
As of the current information, there is no mention of an available patch. However, given the severity of the vulnerability, it is likely that the open-webui/open-webui project will release a patched version soon. The security team should monitor the project's repository or official channels for updates.
Mitigation
Until a patch is available, consider the following mitigation strategies: 1. If possible, disable or restrict access to the vulnerable /api/pipelines/upload endpoint. 2. Implement strict input validation and sanitization for file names and paths on the server side. 3. Use a Web Application Firewall (WAF) to filter out potentially malicious requests. 4. Monitor system logs for any suspicious file operations or unauthorized access attempts. 5. If feasible, consider downgrading to a version prior to v0.3.8 if it's known to be unaffected. 6. Restrict the permissions of the web application to minimize potential damage from file operations. 7. Regularly backup critical data to ensure quick recovery in case of successful attacks.
Timeline
NVD published the first details for CVE-2024-7037
Feedly found the first article mentioning CVE-2024-7037. See article
Feedly estimated the CVSS score as HIGH
CVE-2024-7037 is a critical vulnerability in version v0.3.8 of open-webui/open-webui, allowing arbitrary file write and delete through unsanitized file name handling, potentially leading to remote code execution; it has been assigned a HIGH CVSS score. Currently, there is no evidence of exploitation in the wild or public proof-of-concept exploits, and no patch is available, though mitigation strategies such as restricting access to the vulnerable endpoint and implementing input validation are recommended. The vulnerability poses significant risks, including unauthorized access and data loss, which could impact downstream systems relying on the affected application. See article
EPSS Score was set to: 0.04% (Percentile: 11.2%)