CVE-2024-7806: Remote Code Execution by Non-Admin Users via CSRF in open-webui/open-webui
A vulnerability in open-webui/open-webui versions <= 0.3.8 allows remote code execution by non-admin users via Cross-Site Request Forgery (CSRF). The application uses cookies with the SameSite attribute set to lax for authentication and lacks CSRF tokens. This allows an attacker to craft a malicious HTML that, when accessed by a victim, can modify the Python code of an existing pipeline and execute arbitrary code with the victim's privileges.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-7806?
CVE-2024-7806 is classified as a critical vulnerability due to its capability to allow remote code execution.
How do I fix CVE-2024-7806?
To fix CVE-2024-7806, upgrade open-webui to version 0.3.9 or later, which implements CSRF tokens and adjusts cookie attributes.
Who is affected by CVE-2024-7806?
CVE-2024-7806 affects all users of open-webui versions 0.3.8 and earlier.
What types of attacks can occur due to CVE-2024-7806?
CVE-2024-7806 can facilitate remote code execution attacks, allowing attackers to execute arbitrary code on the server.
Are there any known exploits for CVE-2024-7806?
Yes, there are known exploits for CVE-2024-7806 that leverage the CSRF vulnerabilities to execute unauthorized commands.