Skip to main content

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-7053

High
9/10

Summary

A vulnerability in open-webui allows an attacker with a user-level account to perform a session fixation attack. The session cookie for all users is set with the default "SameSite=Lax" and does not have the "Secure" flag enabled, allowing the session cookie to be sent over HTTP to a cross-origin domain. An attacker can exploit this by embedding a malicious markdown image in a chat, which, when viewed by an administrator, sends the admin's session cookie to the attacker's server. This can lead to a stealthy administrator account takeover, potentially resulting in Remote Code Execution (RCE) due to the elevated privileges of administrator accounts.

  • LOW
  • NETWORK
  • HIGH
  • CHANGED
  • REQUIRED
  • LOW
  • HIGH
  • HIGH

CWE-79 - Cross Site Scripting

Cross-Site Scripting, commonly referred to as XSS, is the most dominant class of vulnerabilities. It allows an attacker to inject malicious code into a pregnable web application and victimize its users. The exploitation of such a weakness can cause severe issues such as account takeover, and sensitive data exfiltration. Because of the prevalence of XSS vulnerabilities and their high rate of exploitation, it has remained in the OWASP top 10 vulnerabilities for years.

References

Advisory Timeline

  • Published