Is CVE-2023-44400 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2023-44400 being exploited in the wild.

How severe is CVE-2023-44400?

Low severity, with a CVSS score of 3.1, published 10 October 2023.

Which products and versions are affected?

uptime-kuma (npm) SEMVER:introduced=0,fixed=1.23.3.

Is there a fix for CVE-2023-44400?

Yes. uptime-kuma (npm): upgrade to 1.23.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2023-44400 attacked?

It is attacked with local access, in a web application.

Am I affected by CVE-2023-44400?

Check whether you run uptime-kuma (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2023-44400: Uptime Kuma persistent session tokens after password change

CVE-2023-44400 · Severity: low · CVSS 3.1 · Published 2023-10-10

Uptime Kuma is an open-source monitoring application that tracks the availability of websites and services. An attacker with local access to a user's device can permanently hijack the user's account by reusing session tokens that remain valid even after password changes or prolonged inactivity. This allows unauthorized access to sensitive monitoring data, API credentials, and the ability to modify or delete monitored services.

Technologies: uptime-kuma (npm). Vendors: npm.

Quick answers

Is CVE-2023-44400 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2023-44400 being exploited in the wild.
How severe is CVE-2023-44400?: Low severity, with a CVSS score of 3.1, published 10 October 2023.
Which products and versions are affected?: uptime-kuma (npm) SEMVER:introduced=0,fixed=1.23.3.
Is there a fix for CVE-2023-44400?: Yes. uptime-kuma (npm): upgrade to 1.23.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-44400 attacked?: It is attacked with local access, in a web application.
Am I affected by CVE-2023-44400?: Check whether you run uptime-kuma (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

uptime-kuma (npm): upgrade to 1.23.3 or later
```
npm install uptime-kuma@1.23.3
```

Technical details

The vulnerability stems from improper session management in Uptime Kuma's JWT token implementation (CWE-565, CWE-602, CWE-784). JWT tokens are stored in browser storage (sessionStorage or localStorage) and lack server-side validation after password changes or timeout periods. Specifically: (1) tokens have no expiration time and remain valid indefinitely, (2) password changes do not invalidate previously issued tokens on the server side, and (3) session tokens are only deleted client-side on logout, making them reusable by local attackers. The attack requires local device access (AV:Local, PR:High privilege level) and no user interaction. An attacker can gain persistent account access to view private monitors, access API keys and secrets, modify monitored endpoints, and exhaust system resources. The vulnerability is fixed in version 1.23.3 and later.

Affected products

Louis Lam Uptime Kuma before 1.23.3

Identifiers

CVE-2023-44400
GHSA-g9v2-wqcj-j99g

Timeline

2023-10-09: disclosed
2023-10-10: patched: fixed in version 1.23.3

References

https://github.com/louislam/uptime-kuma/security/advisories/GHSA-g9v2-wqcj-j99g

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.