CVE-2024-12537
HIGHopen-webui 0.3.32 - Unauthenticated Denial of Service via Code Format Endpoint
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2024-12537. PoCs published by fineman999.
AI-analyzed exploit summary This repository contains a nuclei template and verification script to detect CVE-2024-12537, an unauthenticated denial-of-service vulnerability in Open WebUI's code formatting endpoint. It includes a Docker lab for testing but does not execute a DoS payload.
Description
In version 0.3.32 of open-webui/open-webui, the absence of authentication mechanisms allows any unauthenticated attacker to access the `api/v1/utils/code/format` endpoint. If a malicious actor sends a POST request with an excessively high volume of content, the server could become completely unresponsive. This could lead to severe performance issues, causing the server to become unresponsive or experience significant degradation, ultimately resulting in service interruptions for legitimate users.
Exploits (1)
This repository contains a nuclei template and verification script to detect CVE-2024-12537, an unauthenticated denial-of-service vulnerability in Open WebUI's code formatting endpoint. It includes a Docker lab for testing but does not execute a DoS payload.
References (1)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H