Open WebUI Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in Open WebUI versions prior to 0.6.5. This issue arises from the HTML rendering view, where scripts can be injected and executed. The vulnerability is rooted in the iFrame sandbox directive, which, while intended to restrict content, allows scripts to execute and access the parent’s data, such as local storage. Consequently, the sandbox attribute's protective measures are largely ineffective.

Impact

Exploiting this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user.

Reproduction

To reproduce this vulnerability, include an HTML document with a script in the chat. The script will be executed when the message is viewed. This can be done by, for example, sending a message that fetches data from local storage and sends it to an external server.

Remediation

Users are advised to update to Open WebUI version 0.6.5 or later.