Executive brief
OneUptime is an open-source monitoring and observability platform that uses Probe servers to perform network diagnostics like traceroute. An authenticated user can inject shell commands into the destination field of a network path monitor, causing the Probe server to execute arbitrary operating system commands with the privileges of the monitoring service. This allows attackers to read sensitive files, steal credentials, and potentially compromise other monitoring tenants or internal infrastructure.
Technical details
The vulnerability is an OS command injection (CWE-78) in NetworkPathMonitor.performTraceroute() (lines 149–191 of Probe/Utils/Monitors/MonitorTypes/NetworkPathMonitor.ts). The destination parameter is directly interpolated into a shell command string without sanitization, then executed via child_process.exec(). Since exec() spawns a shell (/bin/sh), shell metacharacters (;, |, $(), ``, &&, ||, \n) in the destination are interpreted as commands. An authenticated project user can craft a payload like "127.0.0.1; id" or "127.0.0.1 | whoami" and execute arbitrary commands on the Probe server. The vulnerability requires authentication and project-level access, but no special privileges are needed beyond creating or editing a network path monitor. No patch has been released as of 2026-02-28.
Affected products
- OneUptime oneuptime <= 10.0.6
Timeline
- 2026-02-25: disclosed: Advisory published on GitHub and OSV
- 2026-02-28: other: No patch released as of latest advisory update