Executive brief
Uptime Kuma is a self-hosted monitoring tool used to track the status of websites and services. A security issue was identified where enabling password protection does not automatically disconnect users who were already accessing the dashboard while it was unprotected. This could allow an unauthorized person with physical or local access to a device to continue managing the monitoring system even after security controls have been turned on.
Technical details
A session management vulnerability exists in Uptime Kuma where the transition from disabled to enabled authentication does not trigger a global session invalidation. When an administrator enables authentication, existing WebSocket connections established during the unauthenticated period remain active and retain full read-write capabilities. This occurs because the server does not explicitly disconnect existing socket clients upon the state change in the authentication settings. An attacker with an existing open session can maintain persistent access without ever being prompted for credentials. The issue is fixed in version 1.23.12 by calling disconnectAllSocketClients when authentication is enabled.
Affected products
- louislam uptime-kuma <= 1.23.11
Timeline
- 2024-04-19: advisory: GitHub Security Advisory published
- 2024-04-19: patched: Fix merged in commit 7a9e2f5
References
- https://github.com/louislam/uptime-kuma/security/advisories/GHSA-23q2-5gf8-gjpp
- https://github.com/louislam/uptime-kuma/security/advisories/GHSA-88j4-pcx8-q4q3
- https://github.com/louislam/uptime-kuma/security/advisories/GHSA-g9v2-wqcj-j99g
- https://github.com/louislam/uptime-kuma/commit/7a9e2f5de69aa0bb884ead25d1dcc833bb8c6579
- https://github.com/louislam/uptime-kuma