CVE-2024-8053: Improper Authentication in open-webui/open-webui
In version v0.3.10 of open-webui/open-webui, the api/v1/utils/pdf endpoint lacks authentication mechanisms, allowing unauthenticated attackers to access the PDF generation service. This vulnerability can be exploited by sending a POST request with an excessively large payload, potentially leading to server resource exhaustion and denial of service (DoS). Additionally, unauthorized users can misuse the endpoint to generate PDFs without verification, resulting in service misuse and potential operational and financial impacts.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-8053?
CVE-2024-8053 is considered a critical vulnerability due to its potential for unauthorized access and resource exhaustion.
How do I fix CVE-2024-8053?
To fix CVE-2024-8053, implement authentication mechanisms for the `api/v1/utils/pdf` endpoint to prevent unauthorized access.
What are the consequences of CVE-2024-8053?
The consequences of CVE-2024-8053 include exposure of sensitive information through unauthorized PDF generation and potential denial of service due to resource exhaustion.
Who is affected by CVE-2024-8053?
CVE-2024-8053 affects all users of open-webui versions prior to v0.3.10.
How can attackers exploit CVE-2024-8053?
Attackers can exploit CVE-2024-8053 by sending a POST request with a large payload to the vulnerable `api/v1/utils/pdf` endpoint.