Open WebUI SSRF via Redirect Bypass in validate_url

This repository contains a single Bash exploit script, exploit_ssrf.sh, targeting Open WebUI v0.9.4. It is a real exploit rather than a detector: it performs authenticated POST requests against two application endpoints to exploit SSRF via HTTP redirect handling. The script requires only a regular user account JWT, not admin privileges, and an attacker-controlled public redirect service. The core weakness described in the script is that Open WebUI validates the initial public URL hostname but then follows a 302 redirect server-side to an internal target, enabling SSRF. The repository structure is minimal: one Bash file with environment-variable configuration, two curl-based exploit paths, and output formatting. No auxiliary code is included beyond references to an external redirect server. The first exploit path, labeled Vector A, sends a POST request to /api/v1/retrieval/process/web?process=false with JSON containing the attacker redirect URL. According to the script comments, the backend validate_url() check is applied only to the initial URL, while requests.get() follows the redirect, allowing server-side access to internal resources and potentially returning readable content to the attacker. This is the stronger exfiltration path. The second path, Vector B, sends a POST request to /api/chat/completions with a message containing an image_url object pointing to the same redirect URL. The script notes that convert_url_images_to_base64() and get_image_base64_from_url() ultimately fetch the URL with redirect following enabled via aiohttp, causing the server to retrieve the redirected internal resource and incorporate the body into downstream LLM processing. This is described as semi-blind because the attacker may get only partial or indirect visibility into the fetched content, though server-side fetch can be confirmed via redirect server logs. Overall, the exploit provides two SSRF primitives against Open WebUI: a more direct retrieval/read vector and a secondary image-fetch vector embedded in chat completion processing. The attack surface is web-based and network-reachable, with the main fingerprintable targets being the Open WebUI API endpoints and the attacker-controlled redirect URL.