Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Informational severity, published 27 November 2023.

Which products and versions are affected?

uptime-kuma (npm) SEMVER:introduced=1.23.0,fixed=1.23.7.

Is there a fix for This vulnerability?

Yes. uptime-kuma (npm): upgrade to 1.23.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a web application.

Check whether you run uptime-kuma (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Uptime Kuma authenticated remote code execution via TailscalePing

Severity: info · Published 2023-11-27

Uptime Kuma is a self-hosted monitoring tool that allows users to add monitors to track system availability. An authenticated attacker can inject arbitrary shell commands into the TailscalePing monitor's hostname field, enabling remote code execution on the server. While authentication is required, the vulnerability can be exploited by removing client-side input validation, allowing an attacker with legitimate access to compromise the entire server and execute arbitrary commands.

Technologies: uptime-kuma (npm). Vendors: npm.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Informational severity, published 27 November 2023.
Which products and versions are affected?: uptime-kuma (npm) SEMVER:introduced=1.23.0,fixed=1.23.7.
Is there a fix for This vulnerability?: Yes. uptime-kuma (npm): upgrade to 1.23.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a web application.
Am I affected?: Check whether you run uptime-kuma (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

uptime-kuma (npm): upgrade to 1.23.7 or later
```
npm install uptime-kuma@1.23.7
```

Technical details

The vulnerability is an OS command injection (CWE-78) in the TailscalePing monitor class. The runTailscalePing method constructs a shell command by directly interpolating the user-supplied hostname parameter into a command string without sanitization: `let cmd = \`tailscale ping ${hostname}\``. The command is then executed via Node.js exec(), which invokes a shell and interprets shell metacharacters. An authenticated attacker can bypass the frontend pattern validation by modifying the DOM or intercepting WebSocket messages (and may also need to disable container detection), then inject a payload like `$(id >&2)` to execute arbitrary commands with the privileges of the Uptime Kuma process. The issue was fixed in version 1.23.7 by switching to the spawn() method with array-based arguments, which does not interpret shell syntax.

Affected products

Louis Lam Uptime Kuma 1.23.0 through 1.23.6

Timeline

2023-11-24: disclosed
2023-11-27: patched: fixed in version 1.23.7

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.