CVE-2024-7959
Published: 20 March 2025
Summary
CVE-2024-7959 is a high-severity SSRF (CWE-918) vulnerability in Openwebui Open Webui. Its CVSS base score is 7.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 33.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
This vulnerability is AI-related — categorised as Enterprise AI Assistants; in the Supply Chain and Deployment risk domain.
The strongest mitigations our analysis identified are NIST 800-53 AC-4 (Information Flow Enforcement) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly requires validation of user-supplied URLs in the /openai/models endpoint to block SSRF exploitation.
Mandates timely remediation of the specific SSRF flaw in open-webui version 0.3.8 through patching or updates.
Enforces policies controlling server-initiated information flows to prevent requests to unauthorized internal or external URLs.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SSRF in public-facing /openai/models endpoint enables exploitation of public-facing application (T1190) and access to internal instance secrets via cloud metadata API (T1552.005).
NVD Description
The `/openai/models` endpoint in open-webui/open-webui version 0.3.8 is vulnerable to Server-Side Request Forgery (SSRF). An attacker can change the OpenAI URL to any URL without checks, causing the endpoint to send a request to the specified URL and return the…
more
output. This vulnerability allows the attacker to access internal services and potentially gain command execution by accessing instance secrets.
Deeper analysisAI
CVE-2024-7959 is a Server-Side Request Forgery (SSRF) vulnerability, mapped to CWE-918, in the `/openai/models` endpoint of open-webui/open-webui version 0.3.8. The flaw enables an attacker to replace the OpenAI URL with any arbitrary URL without validation checks, causing the server to send a request to the attacker-specified URL and return its output. This issue carries a CVSS v3.1 base score of 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N), indicating high severity due to its confidentiality impact and changed scope.
An authenticated attacker with low privileges can exploit this vulnerability remotely over the network with low complexity and no user interaction. By manipulating the endpoint, they can force the server to interact with internal services, potentially exposing sensitive data or instance secrets that enable command execution.
Mitigation guidance is available in the Huntr advisory at https://huntr.com/bounties/3c8bea0a-d678-4d67-bb9c-2b5b610a2193.
Details
- CWE(s)
Affected Products
AI Security AnalysisAI
- AI Category
- Enterprise AI Assistants
- Risk Domain
- Supply Chain and Deployment
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- Open-WebUI is a self-hosted web interface for interacting with LLMs and OpenAI-compatible APIs, functioning as an enterprise-grade AI assistant platform. The vulnerability is in the `/openai/models` endpoint, directly tied to AI model management.