Open-WebUI Remote Code Execution Vulnerability via Cross-Site Request Forgery

A remote code execution vulnerability has been identified in Open-WebUI versions through 0.3.8. This issue allows non-admin users to execute arbitrary code by exploiting Cross-Site Request Forgery (CSRF) vulnerabilities. The application uses cookies for authentication with the SameSite attribute set to lax, and it lacks CSRF tokens. This combination enables an attacker to create a malicious HTML document that, when opened by a victim, can alter the Python code of an existing pipeline and execute arbitrary code with the victim's privileges.

Impact

Exploitation of this vulnerability allows for remote code execution on the affected system, executed with the privileges of the user who was targeted by the CSRF attack.