Is CVE-2023-49276 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2023-49276 being exploited in the wild.

How severe is CVE-2023-49276?

Low severity, with a CVSS score of 3.1, published 24 November 2023.

Which products and versions are affected?

uptime-kuma (npm) SEMVER:introduced=1.20.0,fixed=1.23.7.

Is there a fix for CVE-2023-49276?

Yes. uptime-kuma (npm): upgrade to 1.23.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2023-49276 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2023-49276?

Check whether you run uptime-kuma (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2023-49276: Louis Lam Uptime Kuma attribute injection leading to XSS

CVE-2023-49276 · Severity: low · CVSS 3.1 · Published 2023-11-24

Uptime Kuma is a web-based service status monitoring and page application. An unsanitized input field in the custom status page's Google Analytics configuration allows authenticated administrators to inject arbitrary HTML attributes and JavaScript code, which executes in the browsers of other users viewing the status page. This can lead to session hijacking, credential theft, or malware delivery targeting status page visitors.

Technologies: uptime-kuma (npm). Vendors: npm.

Quick answers

Is CVE-2023-49276 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2023-49276 being exploited in the wild.
How severe is CVE-2023-49276?: Low severity, with a CVSS score of 3.1, published 24 November 2023.
Which products and versions are affected?: uptime-kuma (npm) SEMVER:introduced=1.20.0,fixed=1.23.7.
Is there a fix for CVE-2023-49276?: Yes. uptime-kuma (npm): upgrade to 1.23.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-49276 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2023-49276?: Check whether you run uptime-kuma (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

uptime-kuma (npm): upgrade to 1.23.7 or later
```
npm install uptime-kuma@1.23.7
```

Technical details

The vulnerability is an attribute injection / cross-site scripting (XSS) flaw (CWE-79) in the custom status page interface. The Google Analytics ID field is not sanitized before being rendered in the HTML template, allowing an authenticated user with status page editing privileges to inject malicious attributes such as onafterscriptexecute= and arbitrary JavaScript code. The attack requires network access and administrative privileges (low privilege requirement) plus user interaction to view the compromised status page, but can result in high integrity impact through script execution in users' browsers. The vulnerability affects versions 1.20.0 through 1.23.6 and was patched in version 1.23.7.

Affected products

Louis Lam Uptime Kuma >=1.20.0, <=1.23.6

Identifiers

CVE-2023-49276
GHSA-v4v2-8h88-65qj

Timeline

2023-11-24: disclosed
2023-11-24: patched: Version 1.23.7 released

References

https://github.com/louislam/uptime-kuma/security/advisories/GHSA-v4v2-8h88-65qj

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.