Executive brief
Uptime Kuma is a web-based service status monitoring and page application. An unsanitized input field in the custom status page's Google Analytics configuration allows authenticated administrators to inject arbitrary HTML attributes and JavaScript code, which executes in the browsers of other users viewing the status page. This can lead to session hijacking, credential theft, or malware delivery targeting status page visitors.
Technical details
The vulnerability is an attribute injection / cross-site scripting (XSS) flaw (CWE-79) in the custom status page interface. The Google Analytics ID field is not sanitized before being rendered in the HTML template, allowing an authenticated user with status page editing privileges to inject malicious attributes such as onafterscriptexecute= and arbitrary JavaScript code. The attack requires network access and administrative privileges (low privilege requirement) plus user interaction to view the compromised status page, but can result in high integrity impact through script execution in users' browsers. The vulnerability affects versions 1.20.0 through 1.23.6 and was patched in version 1.23.7.
Affected products
- Louis Lam Uptime Kuma >=1.20.0, <=1.23.6
Timeline
- 2023-11-24: disclosed
- 2023-11-24: patched: Version 1.23.7 released