Regular Expression Denial of Service in Open WebUI

Executive Summary

Open WebUI versions 0.11.0 to 0.11.4 have a regular expression denial of service flaw. Authenticated users can exploit this by sending file search patterns that use catastrophically backtracking regular expressions. This causes the server's event loop to stall for two seconds per repeated call, blocking workers and disrupting service.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for unusually high CPU usage or stalled processes during file search operations in Open WebUI. Check logs for repeated calls to grep_knowledge_files or grep_chat_files with complex regex patterns. No specific commands are provided in the context.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can degrade server performance or crash it entirely by consuming excessive CPU resources. It may lead to denial of service, preventing legitimate users from accessing the Open WebUI service. Persistent exploitation could require server restarts or resource scaling to mitigate.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily impacts availability by allowing authenticated users to stall server workers through regex-based file searches, causing denial-of-service conditions. For compliance standards like GDPR and HIPAA, which require data availability and integrity, such disruptions could lead to violations if systems fail to meet uptime or responsiveness requirements during an attack.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Open WebUI to version 0.11.4 or later to address the regex denial of service issue. Restrict authenticated user access to file search functions if possible. Monitor server performance for signs of exploitation.

Useful 0 Not Useful 0