Authentication Flaw in Open-WebUI Affects Performance

CVE-2024-12537

Summary

In version 0.3.32 of Open-WebUI, a critical security flaw exists due to the lack of authentication mechanisms. This vulnerability allows any unauthenticated attacker to send requests to the api/v1/utils/code/format endpoint. By submitting a POST request containing an excessively high volume of content, an attacker can overwhelm the server, leading to severe performance issues. This behavior may result in the server becoming unresponsive, significantly degrading performance, and causing prolonged service interruptions for legitimate users.

References