open-webui Markdown Conversion Endpoint Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in open-webui version 0.3.8. The issue arises from an endpoint that converts markdown to HTML, which is exposed without authentication. A maliciously crafted markdown payload can be sent to this endpoint, causing the server to spend an excessive amount of time processing the conversion. As a result, the server becomes unresponsive to other requests until the conversion is complete, leading to a significant degradation of service.

Impact

Exploitation of this vulnerability causes a complete denial-of-service, with the server becoming unresponsive to all requests for an extended period.

Reproduction

To reproduce this vulnerability, upload a large markdown payload to the unprotected markdown conversion endpoint. This can be done using a Python script that sends a POST request to the endpoint with the payload. While the request is being processed, both the front-end and API will become unresponsive.

Remediation

It is recommended to implement authentication for the markdown conversion endpoint and to sanitize or detect excessively large payloads before processing.