fkie_cve-2024-8060
Vulnerability from fkie_nvd
Published
2025-03-20 10:15
Modified
2025-03-20 10:15
Severity ?
8.1 (High) - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Summary
OpenWebUI version 0.3.0 contains a vulnerability in the audio API endpoint `/audio/api/v1/transcriptions` that allows for arbitrary file upload. The application performs insufficient validation on the `file.content_type` and allows user-controlled filenames, leading to a path traversal vulnerability. This can be exploited by an authenticated user to overwrite critical files within the Docker container, potentially leading to remote code execution as the root user.
References
security@huntr.devhttps://huntr.com/bounties/a3b1a4b7-c723-496d-842c-844cc0988fe9
Impacted products
Vendor Product Version


To clipboard 

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "OpenWebUI version 0.3.0 contains a vulnerability in the audio API endpoint `/audio/api/v1/transcriptions` that allows for arbitrary file upload. The application performs insufficient validation on the `file.content_type` and allows user-controlled filenames, leading to a path traversal vulnerability. This can be exploited by an authenticated user to overwrite critical files within the Docker container, potentially leading to remote code execution as the root user."
    },
    {
      "lang": "es",
      "value": "La versi\u00f3n 0.3.0 de OpenWebUI contiene una vulnerabilidad en el endpoint de la API de audio `/audio/api/v1/transcriptions` que permite la carga de archivos arbitrarios. La aplicaci\u00f3n realiza una validaci\u00f3n insuficiente en `file.content_type` y permite nombres de archivo controlados por el usuario, lo que genera una vulnerabilidad de path traversal. Un usuario autenticado puede aprovechar esta vulnerabilidad para sobrescribir archivos cr\u00edticos dentro del contenedor Docker, lo que podr\u00eda provocar la ejecuci\u00f3n remota de c\u00f3digo como usuario root."
    }
  ],
  "id": "CVE-2024-8060",
  "lastModified": "2025-03-20T10:15:40.373",
  "metrics": {
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
          "version": "3.0"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.2,
        "source": "security@huntr.dev",
        "type": "Secondary"
      }
    ]
  },
  "published": "2025-03-20T10:15:40.373",
  "references": [
    {
      "source": "security@huntr.dev",
      "url": "https://huntr.com/bounties/a3b1a4b7-c723-496d-842c-844cc0988fe9"
    }
  ],
  "sourceIdentifier": "security@huntr.dev",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-434"
        }
      ],
      "source": "security@huntr.dev",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.