Open WebUI Server-Side Request Forgery Bypass Vulnerability

A server-side request forgery (SSRF) bypass vulnerability has been identified in Open WebUI versions prior to 0.9.5. This vulnerability arises from a parsing discrepancy between the urlparse and requests libraries, allowing maliciously crafted URLs to bypass validation and access internal resources.

Impact

Exploitation of this vulnerability allows for server-side request forgery, where an attacker can manipulate server-side requests to access internal services or resources.

Reproduction

The vulnerability can be reproduced by sending a request with a URL that includes a backslash followed by an '@' symbol, such as 'http://127.0.0.1:6666\@1.1.1.1'. The 'validate_url' function will parse this as a public IP address, bypassing the intended validation and allowing access to the internal service.

Remediation

Users are advised to update to Open WebUI version 0.9.5 or later, where this vulnerability has been patched.