Open Web UI PDF Generation Service Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in open-webui/open-webui version 0.3.10. The issue arises in the 'api/v1/utils/pdf' endpoint, which lacks authentication, allowing unauthenticated attackers to access the PDF generation service. Exploitation involves sending a POST request with a large payload, potentially exhausting server resources and causing a denial-of-service condition. Additionally, unauthorized users can generate PDFs through this endpoint without any verification, leading to service misuse and possible operational and financial repercussions.

Impact

Exploitation of this vulnerability can cause server resource exhaustion, leading to a denial-of-service condition.