Summary
Open WebUI's Playwright web loader validates only the initial page request and does not consistently validate requests for sub-resources loaded by that page. An authenticated user who can supply a page may use JavaScript to access restricted internal addresses, causing data from those addresses to appear in web-search or retrieval-augmented generation (RAG) results.
Affected context
The issue occurs in Open WebUI deployments that use the Playwright web loader through the WEB_LOADER_ENGINE=playwright setting. It becomes risky when authenticated users can provide or cause the loading of web content, and the browser automation environment can reach internal services or cloud metadata endpoints that should not be exposed to it.
Exploit preconditions
- Attack surface: The Playwright-based web loading and web-search or RAG retrieval workflow
- Required access: An authenticated account with the ability to submit or cause a page to be loaded
- Trigger point: JavaScript running in the supplied page initiates sub-resource requests
- Why exploitation is possible: The loader checks the top-level navigation request but does not apply equivalent validation to subsequent browser requests, allowing access to otherwise restricted internal addresses
Why this happens
The underlying bug is incomplete server-side request validation in a browser-based fetcher. Validation is applied to the initial URL, while requests initiated by page scripts, such as sub-resource loads, are allowed to proceed without the same network-boundary checks. This behavior maps to CWE-918: Server-Side Request Forgery, because attacker-influenced content can cause a server-controlled browser to make requests to internal or otherwise restricted destinations.
Potential impact
- Internal services or administrative interfaces may be reached from the loader environment
- Cloud instance metadata or other sensitive endpoint data could be disclosed
- Confidential internal content may appear in search or RAG responses
- Network segmentation assumptions may be weakened
- Retrieved data could be used to influence downstream AI responses or workflows
General mitigation guidance
Mitigation generally focuses on enforcing network policy for every browser request, not only the initial navigation.
Common defensive patterns include:
- Apply consistent destination validation to top-level requests, redirects, sub-resource requests, and script-initiated requests
- Use an explicit outbound allowlist for permitted domains and schemes
- Block loopback, link-local, private, and internal address ranges, including alternate address representations
- Restrict the Playwright runtime with egress firewall rules, isolated networking, and minimal service permissions
- Reduce trust in user-supplied pages and treat browser-rendered content as untrusted input
- Prevent sensitive internal services from accepting requests from the loader environment
How teams detect issues like this
Organizations can look for SSRF exposure through:
- Static analysis and code review checks for validation applied only to the initial URL
- Review of browser automation callbacks, request interception, redirect handling, and sub-resource controls
- Tests covering JavaScript-triggered requests to loopback, private, link-local, and metadata addresses
- Egress proxy and firewall logs showing loader-originated connections to restricted network ranges
- Monitoring web-search and RAG retrieval results for unexpected internal hostnames or sensitive endpoint content
- Automated security review tools that flag server-side fetchers without comprehensive outbound policy enforcement
