Detect an exposed Ollama API and an open Open WebUI

Two more read only checks for self-hosted AI tools, the sort attackers hunt to
run their own work on someone else's compute and model keys.

Ollama has no built-in authentication, so an instance that answers from outside
is open to anyone to run its models, pull and register models, and read what is
installed.  The check confirms it by the string Ollama returns at its root and
by the model listing it serves, against a control.

Open WebUI publishes in its config whether signup is open or authentication is
off.  The check reads that public config and fires when either is true, which
means a stranger can use the AI.  The remediation says how to close it and to
rotate the model keys if strangers may have reached it.

Both are plain GET requests that fetch, never change, and send no credentials.

Author: hackrange

app/core/dast_checks/curated/misconfiguration-ollama-exposed.json

@@ -0,0 +1,26 @@
+{
+  "id": "misconfiguration-ollama-exposed",
+  "class": "misconfiguration",
+  "safety": "read",
+  "severity_floor": "high",
+  "title": "Ollama API is exposed without authentication",
+  "summary": "An Ollama server is answering without any login.  Ollama has no built-in authentication, so anyone who can reach it can run its models on the organization's hardware, pull and register models, and read what is installed.  Exposed Ollama servers are actively taken over to run attackers' work on someone else's compute.",
+  "needs": [],
+  "candidate_paths": [
+    "/",
+    "/api/tags"
+  ],
+  "probe": [
+    { "request": { "method": "GET", "path": "{route}" } }
+  ],
+  "confirm": {
+    "control": "A path that cannot exist, so the site's not found answer is known and the Ollama response is told apart from a soft 404.",
+    "differential": "status == 200 and (body_contains(\"Ollama is running\") or (body_contains(\"\\\"models\\\"\") and body_contains(\"\\\"digest\\\"\"))) and body_differs(control)",
+    "retest": 2
+  },
+  "reproduce": "curl -sk 'https://host/' (it answers 'Ollama is running') or 'https://host/api/tags' (it lists the installed models as JSON).  If either answers without a login, the Ollama API is open to anyone.",
+  "remediate": "Bind Ollama to 127.0.0.1, firewall its port (11434 by default) off the internet, and put any remote access behind an authenticated reverse proxy or VPN.  Treat the models and the host as reachable by strangers until it is closed.",
+  "references": [],
+  "mappings": { "cwe": "CWE-306", "owasp": "A05:2021" },
+  "rulesets": ["ollama"]
+}

app/core/dast_checks/curated/misconfiguration-open-webui-open-access.json

@@ -0,0 +1,22 @@
+{
+  "id": "misconfiguration-open-webui-open-access",
+  "class": "access-control",
+  "safety": "read",
+  "severity_floor": "high",
+  "title": "Open WebUI lets anyone in (open signup or no authentication)",
+  "summary": "This Open WebUI instance reports from its public config that signup is open, or that authentication is turned off entirely.  Either way a stranger who can reach it can use the AI, which runs on the organization's model keys or hardware, and keep an account as a foothold.",
+  "needs": [],
+  "probe": [
+    { "request": { "method": "GET", "path": "/api/config" } }
+  ],
+  "confirm": {
+    "control": "A path that cannot exist, so the site's not found answer is known and the config response is told apart from a soft 404.",
+    "differential": "status == 200 and body_contains(\"enable_login_form\") and body_contains(\"enable_signup\") and (body_contains(\"\\\"auth\\\":false\") or body_contains(\"\\\"enable_signup\\\":true\")) and body_differs(control)",
+    "retest": 2
+  },
+  "reproduce": "curl -sk 'https://host/api/config' and read the JSON features: enable_login_form and enable_signup confirm it is Open WebUI.  \"auth\":false means authentication is off; \"enable_signup\":true means anyone can register.  Either way the instance is open.",
+  "remediate": "Turn signup off (ENABLE_SIGNUP false, or Enable New Sign Ups in the admin panel) and keep authentication on (WEBUI_AUTH true).  Put the instance behind single sign on or the gateway so only staff reach it, and rotate the model keys if strangers may have used them.",
+  "references": [],
+  "mappings": { "cwe": "CWE-1188", "owasp": "A05:2021" },
+  "rulesets": ["open-webui"]
+}