open-webui: Deactivated users keep terminal command execution via an already open terminal WebSocket

Deactivated users keep terminal command execution via an already open terminal WebSocket

Summary

When an administrator deactivates a user by setting their role to pending, Open WebUI refuses that user's later HTTP requests and new WebSocket handshakes. A terminal WebSocket the user had already opened stayed connected and kept forwarding their commands to the terminal server. Nothing re-checked the user's access once the connection was established, so deactivation did not cut off an open terminal.

Preconditions

• An administrator has configured at least one terminal server connection (none exist by default) and granted the user access to it.
• The user has a terminal session open in the Open WebUI interface at the moment they are deactivated.
• No other knowledge is needed. The user only keeps the already open terminal tab.

Deployments without a configured terminal server are not affected.

Impact

A deactivated user who kept a terminal open can keep running commands on the terminal server as before, including reading and writing files there, until the connection closes for some other reason. The access is the same the user held before deactivation, so exploitation needs no skill, only an open tab at the right moment. Deactivation therefore does not give an administrator an immediate way to cut off a terminal user. Accounts that never had terminal access gain nothing.

Fix

Fixed in commit e8bd0661d. Every open terminal session now re-checks the user's access every ten seconds: the token is still valid, the user still exists and holds an approved role, the terminal server is still configured and enabled, and the user still has access to it. The session is closed when any check fails. After upgrading, a revoked user loses an open terminal within about ten seconds.

Root cause

• Component: the terminal proxy WebSocket route (/api/v1/terminals/{server_id}/api/terminals/{session_id}) in backend/open_webui/routers/terminals.py.
• Affected setup: every release from 0.8.8 (where the terminal WebSocket proxy was introduced) up to and including 0.11.3.

The proxy authenticated the user and checked their access to the terminal server only once, on the first message of the connection, and then relayed every later frame in both directions. The role change handling that disconnects a user's live Socket.IO sessions does not reach this raw WebSocket, and no periodic check existed. So a connection opened while the user was allowed stayed usable after that permission was withdrawn.

Proof of concept

Reproduced by the reporter on Open WebUI 0.11.3 with the official Open Terminal container:

1. Give an ordinary user access to a configured terminal server.
2. Sign in as that user, open the terminal in the Open WebUI interface and run a command, for example whoami; hostname; date -u.
3. As an administrator, change the user's role to pending.
4. Without reloading the page or reconnecting, send date -u; echo post_deactivation_write > /tmp/owui-proof; cat /tmp/owui-proof through the same terminal. It runs and prints post_deactivation_write after the recorded role change.
5. Reload the browser. Open WebUI now shows "Account Activation Pending" for the same account.

Independently confirmed on real 0.11.3 and 0.11.4 backends, with a stand-in echo server in place of the terminal server. On 0.11.3, commands sent 1 and 12 seconds after the role change both reached the terminal server. On 0.11.4, the proxy closed the connection within the ten-second check interval and later commands were no longer forwarded.

Credits

@zyakir13 reported the issue with a live demonstration against a running instance.