| Package | Affected versions | Patched versions |
|---|---|---|
| uptime kuma | < 1.23.3 | 1.23.3 |
| uptime-kuma | < 1.23.3 | 1.23.3 |
Attackers with access to a users' device can gain persistent account access. This is caused by missing verification of Session Tokens after password changes and/or elapsed inactivity-periods.
uptime-kuma sets JWT tokens for users after successful authentication.
These tokens have the following design flaws:
sessionStorage or localStorage.
Which of the two is decided based on the Remember Me button.
The users' token is valid without any time limitation, even after long periods of inactivity.
This increases the risk of session hijacking if, for example, a user forgets to log off and leaves the PC.These flaws allow user cookies to remain valid even after changing passwords or being inactive, posing a high security risk.
In testing, even after a period of over a day of inactivity, the session was still valid
Another person with local access to the device could take over the session permanently, even after hours of previous inactivity or a password change. Such activity would not be obvious to the user (see https://github.com/louislam/uptime-kuma/issues/3481 if you want to help with this).
With this gained account access, an attacker can cause:
api-keys (only used for accessing /metrics)Steam API KeyRunning one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site freeHTTP(s) - Browser Engine (Chrome/Chromium) (Beta) leading to RAM exhaustionIf operated in some restricted network, access to monitors may provide the ability to change the scope of the attack to a different piece of infrastructure, for example via SQL commands to a database server.
We have not classified this as changed scope because credentials stored in the application for accessing other systems are existing valid paths across the trust boundary, and the user should be aware of that.