Viewer session token theft via javascript: URLs in chat message links

Viewer session token theft via javascript: URLs in chat message links

Summary

Any authenticated user could place a markdown link with a javascript: URL in content that another user later views, such as a shared chat. The link was rendered as a clickable anchor with the URL unchanged, because the markdown renderer never checked the link's scheme. When the victim clicked it in an affected browser, the script ran inside Open WebUI in the victim's session and could read their session token.

Preconditions

• The attacker has any regular account with the chat sharing permission (chat.share, on by default).
• The victim can open the attacker's shared chat: they were granted access to the share, or they are an admin (admins can open any shared chat by default, ENABLE_ADMIN_CHAT_ACCESS=true). Channel messages render through the same component when channels are enabled (ENABLE_CHANNELS, off by default).
• The victim clicks the link. A plain click triggers it in Safari and every other WebKit browser (which includes every browser on iOS). In Firefox it takes a middle click or a Ctrl/Shift click. Chromium-based browsers do not run it.
• No Content-Security-Policy header is set, which is the default.

Impact

The attacker's script runs in the Open WebUI origin as the victim. It reads the victim's JWT from local storage and sends it to the attacker, who can then use the API with the victim's full permissions. If the victim is an admin, that means the whole instance. The attacker needs the victim to open the shared chat and click the link in an affected browser (see Preconditions). Victims on Chromium-based browsers are not affected, and neither is any deployment that sets a CSP forbidding inline script.