GHSA-gmfw-g93r-vg53

Описание

Summary

The Socket.IO server is configured with always_connect=True (lines 78, 91 in backend/open_webui/socket/main.py) and the connect handler (line 329) never rejects unauthenticated connections. Two Ydoc event handlers have zero authentication checks, allowing unauthenticated clients to interact with collaborative document sessions.

Vulnerable Code

ydoc:awareness:update (line 741) — No auth check at all

ydoc:document:leave (line 711) — No auth check at all

Root Cause: always_connect=True (line 78)

The connect handler (line 329) adds authenticated users to SESSION_POOL but never returns False or raises an exception for unauthenticated connections.

Exploitation

1. An unauthenticated attacker connects via Socket.IO (no token needed)
2. The attacker emits ydoc:awareness:update with:
   • document_id: a known/guessed note UUID (format: note:{uuid})
   • user_id: spoofed to impersonate any user
   • update: arbitrary awareness data (fake cursor positions, selections)
3. The fake awareness data is broadcast to all legitimate users in the document room
4. The attacker can also emit ydoc:document:leave with spoofed user_id to broadcast fake ydoc:user:left events

Impact

• UI disruption: Fake cursor positions and user presence in collaborative editing sessions
• User impersonation: Attacker can spoof any user_id in awareness updates
• Resource exhaustion: Unlimited unauthenticated WebSocket connections maintained by the server

Note: Other Ydoc handlers (ydoc:document:join, ydoc:document:update, ydoc:document:state) correctly check SESSION_POOL membership.

Suggested Fix

1. Set always_connect=False or reject unauthenticated connections in the connect handler
2. Add SESSION_POOL checks to ydoc:awareness:update and ydoc:document:leave
3. Add room membership verification before broadcasting to document rooms

AI Disclosure (per Rule 11): AI (Claude) was used to assist with source code review, identifying potential vulnerability patterns, and drafting this report. The researcher directed the analysis, selected focus areas, and independently verified all findings against a running v0.8.12 Docker instance using real HTTP requests with two test accounts. The PoCs included are reproducible and were confirmed live before submission.