open-webui Session Fixation Vulnerability Allowing Administrator Account Takeover

A session fixation vulnerability has been identified in open-webui version 0.3.8. This issue allows an attacker with a user-level account to exploit the session management of the application. The vulnerability arises because the session cookie for all users is configured with the default 'SameSite=Lax' and lacks the 'Secure' flag, enabling the cookie to be transmitted over HTTP to a cross-origin domain. An attacker can embed a malicious markdown image in a chat, which, when viewed by an administrator, sends the admin's session cookie to the attacker's server. This exploitation can lead to a stealthy takeover of the administrator's account, with the potential for remote code execution due to the elevated privileges of admin accounts.

Impact

Exploitation of this vulnerability allows for a covert takeover of an administrator account. In version 0.3.8 of open-webui, administrators have the capability to upload and execute arbitrary code, thereby extending the impact to remote code execution.

Reproduction

To reproduce this vulnerability, first, create a user account and an administrator account. Log into the user account and initiate a chat with an LLM. After the LLM responds, edit the message to include a markdown image link pointing to a server controlled by the attacker. Then, log into the administrator account and access the chat that was modified. The admin's session cookie will be sent to the attacker's server, allowing for account takeover.

Remediation

It is recommended to enhance cookie security, particularly for session cookies assigned to administrators. Additionally, increasing administrator awareness and visibility regarding chat reviews could help mitigate this vulnerability.