Open WebUI Stored Cross-Site Scripting Vulnerability Allowing Arbitrary Code Execution

A stored cross-site scripting vulnerability has been identified in Open WebUI version 0.3.8. The issue arises in the '/api/v1/models/add' endpoint, where the model description field is not properly sanitized before being displayed in chat. This flaw enables an attacker to inject malicious scripts that can be executed by any user, including administrators. The exploitation of this vulnerability could lead to arbitrary code execution on the server.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the chat. This can escalate to arbitrary code execution on the server, particularly if the malicious model is used in a way that triggers the execution of the injected code.

Reproduction

To reproduce this vulnerability, first create a model file with a crafted payload that includes a script injection, such as an image tag with an 'onerror' event. This payload bypasses the sanitization by the 'sanitizeResponseContent' function, which is supposed to secure the content before it is rendered in chat. After adding the model with the injected script, selecting the model from the dropdown menu will execute the script, demonstrating the cross-site scripting vulnerability. To escalate this to arbitrary code execution, the injected script can be crafted to execute a reverse shell payload, exploiting the application's functionality to run Python code on the server.