Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Informational severity, with a CVSS score of 3.3, published 19 April 2024.

Which products and versions are affected?

uptime-kuma (npm) SEMVER:introduced=0,fixed=1.23.12.

Is there a fix for This vulnerability?

Yes. uptime-kuma (npm): upgrade to 1.23.12 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked with local access, in a network appliance.

Check whether you run uptime-kuma (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Louislam Uptime Kuma session persistence when enabling authentication

Severity: info · CVSS 3.3 · Published 2024-04-19

Uptime Kuma is a self-hosted monitoring tool used to track the status of websites and services. A security issue was identified where enabling password protection does not automatically disconnect users who were already accessing the dashboard while it was unprotected. This could allow an unauthorized person with physical or local access to a device to continue managing the monitoring system even after security controls have been turned on.

Technologies: uptime-kuma (npm). Vendors: npm.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Informational severity, with a CVSS score of 3.3, published 19 April 2024.
Which products and versions are affected?: uptime-kuma (npm) SEMVER:introduced=0,fixed=1.23.12.
Is there a fix for This vulnerability?: Yes. uptime-kuma (npm): upgrade to 1.23.12 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked with local access, in a network appliance.
Am I affected?: Check whether you run uptime-kuma (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

uptime-kuma (npm): upgrade to 1.23.12 or later
```
npm install uptime-kuma@1.23.12
```

Technical details

A session management vulnerability exists in Uptime Kuma where the transition from disabled to enabled authentication does not trigger a global session invalidation. When an administrator enables authentication, existing WebSocket connections established during the unauthenticated period remain active and retain full read-write capabilities. This occurs because the server does not explicitly disconnect existing socket clients upon the state change in the authentication settings. An attacker with an existing open session can maintain persistent access without ever being prompted for credentials. The issue is fixed in version 1.23.12 by calling disconnectAllSocketClients when authentication is enabled.

Affected products

louislam uptime-kuma <= 1.23.11

Timeline

2024-04-19: advisory: GitHub Security Advisory published
2024-04-19: patched: Fix merged in commit 7a9e2f5

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.