CVE-2024-8053

Description

In version v0.3.10 of open-webui/open-webui, the `api/v1/utils/pdf` endpoint lacks authentication mechanisms, allowing unauthenticated attackers to access the PDF generation service. This vulnerability can be exploited by sending a POST request with an excessively large payload, potentially leading to server resource exhaustion and denial of service (DoS). Additionally, unauthorized users can misuse the endpoint to generate PDFs without verification, resulting in service misuse and potential operational and financial impacts.

Reserved 2024-08-21 | Published 2025-03-20 | Updated 2025-03-27 | Assigner @huntr_ai

Problem types

CWE-306 Missing Authentication for Critical Function

Product status

Any version
affected

References

huntr.com/bounties/ebe8c1fa-113b-4df9-be03-a406b9adb9f4

cve.org (CVE-2024-8053)

nvd.nist.gov (CVE-2024-8053)

Download JSON