Know every vulnerabilitybefore it knows you.
DevGuard continuously monitors your dependencies and alerts you when CVEs like this one affect your stack — with real-time threat intelligence built for developers.
GHSA-qg3f-8x3j-ggf2
No affected components available
Summary
The administrator-configured WEB_FETCH_FILTER_LIST (the allow/block list applied to server-side web fetches: RAG URL ingestion, URL-to-markdown, web-search content fetch) matches hostnames incorrectly, so the filter can be bypassed.
Details
is_string_allowed (backend/open_webui/utils/misc.py) matches with str.endswith(...), and the primary web-fetch call site (backend/open_webui/retrieval/web/utils.py) called it with the full URL string, not the hostname:
- Blocklist bypass via path. A blocklist entry
!internal.example.comonly matches a URL that ends with that string. Any URL with a path (https://internal.example.com/x) ends with/x, so the entry never matches and the fetch proceeds. The blocklist effectively only stopped path-less URLs. - Allowlist false-reject and bypass. An allowlist
company.comrejected the legitimatehttps://api.company.com/statusand admittedhttps://attacker.example/path/company.com. - Non-label-boundary matching at the hostname-shaped call site (
retrieval/web/main.py):endswith('corp.com')also matchedevilcorp.com, and10.0.0.1matched110.0.0.1.
Impact
An authenticated user able to trigger a server-side web fetch can reach hosts the administrator intended to block with WEB_FETCH_FILTER_LIST.
Open WebUI's primary SSRF protection is a separate, always-on guard that rejects any URL resolving to a non-global IP (validate_url and the connection-layer _ssrf_safe_new_conn, active whenever ENABLE_RAG_LOCAL_WEB_FETCH is off, the default). That guard is unaffected by this issue and continues to block loopback, RFC1918 and link-local addresses, including the 169.254.169.254 cloud-metadata endpoint. This bypass therefore does not grant access to those internal targets. What it defeats is the administrator's ability to block specific publicly-resolvable hosts (internal services reachable from the server over a public IP, e.g. split-horizon DNS or internal PaaS endpoints) and to enforce an allowlist. Fetched content is returned to the requester, so for hosts reachable from the server's network position this is a read/content-disclosure SSRF against the admin-blocked host.
Patch
Matching is now performed on the parsed hostname using DNS label boundaries. A dedicated is_host_allowed(host, ...) matches an entry only when host and entry are equal or the entry is a parent domain (host == entry or host.endswith('.' + entry)), so corp.com matches api.corp.com but not evilcorp.com, and IP entries match only the identical address. Both web-fetch call sites pass the parsed hostname rather than the full URL. The generic is_string_allowed is retained unchanged for unrelated non-host filters.
Credit
Reported by @addcontent.
The vulnerability can be exploited over the network without needing physical access. It is easy for an attacker to exploit this vulnerability. An attacker needs basic access or low-level privileges. No user interaction is needed for the attacker to exploit this vulnerability. The impact is confined to the system where the vulnerability exists. There is a low impact on the confidentiality of the information.
Exploitation attempts have been detected. Elevated vigilance and prompt remediation are advised.
The exploit probability is very low. The vulnerability is unlikely to be exploited in the next 30 days.
We did not find any exploit available. Neither in GitHub repositories nor in the Exploit-Database.
Browse More
Continuously monitor your dependencies and get alerted when vulnerabilities like this one affect your stack.
Checkout DevGuard