Executive brief
Uptime Kuma is an open-source tool used to monitor the availability of websites and services. A security flaw in its 'Real-Browser' monitoring feature allows an authorized user to trick the system into taking screenshots of sensitive files stored on the server, such as password files or the application's own database. This could lead to the exposure of administrative credentials and other private system information.
Technical details
A Local File Inclusion (LFI) vulnerability exists in Uptime Kuma's 'Real-Browser' monitor type due to insufficient server-side validation of user-provided URLs. While the frontend uses a regex pattern to suggest HTTP(S) protocols, the backend fails to enforce these restrictions, allowing the use of the 'file://' or 'view-source:file://' protocols. An authenticated attacker can create a monitor pointing to sensitive local paths (e.g., /etc/passwd or the Kuma database). The application then uses a headless browser to navigate to these paths and saves a screenshot of the file content, which can be retrieved by the attacker. This issue is fixed in versions 1.23.16 and 2.0.0-beta.1.
Affected products
- louislam uptime-kuma 1.23.0 - 1.23.15, 2.0.0-beta.0
Timeline
- 2024-12-20: disclosed
- 2024-12-20: advisory
- 2024-12-20: patched