PT-2023-25713 · Unknown+1 · Uptime Kuma+1

N-Thumann · Published 2023-07-05 · Updated 2024-05-01 · CVE-2023-36821

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Uptime Kuma versions prior to 1.22.1

Description The issue allows an authenticated attacker to install a maliciously crafted plugin, potentially leading to remote code execution. Uptime Kuma permits authenticated users to install plugins from an official list, although this feature is currently disabled in the web interface. The corresponding API endpoints remain available after login. A malicious plugin can exploit npm scripts to gain remote code execution because the plugin is not validated against the official list or installed with npm install --ignore-scripts.

Recommendations For versions prior to 1.22.1, update to version 1.22.1 or later to resolve the issue. As a temporary workaround, consider disabling the plugin installation feature until a patch is available. Restrict access to the API endpoints related to plugin installation to minimize the risk of exploitation. Avoid using the npm install command without the --ignore-scripts option in the plugin installation directory until the issue is resolved.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2023-36821

GHSA-7GRX-F945-MJ96

Affected Products

Uptime Kuma

Npm

References · 11

• 🔥 https://github.com/louislam/uptime-kuma/security/advisories/GHSA-7grx-f945-mj96 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/36xxx/CVE-2023-36821.json · Exploit
• https://github.com/louislam/uptime-kuma/pull/3346 · Patch
• https://osv.dev/vulnerability/CVE-2023-36821 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-36821 · Security Note
• https://osv.dev/vulnerability/GHSA-7grx-f945-mj96 · Vendor Advisory
• https://github.com/louislam/uptime-kuma · Note
• https://github.com/louislam/uptime-kuma/commit/a0736e04b2838aae198c2110db244eab6f87757b · Note
• https://github.com/louislam/uptime-kuma/releases/tag/1.22.1 · Note
• https://github.com/louislam/uptime-kuma/blob/8c60e902e1c76ecbbd1b0423b07ce615341cb850/server/plugins-manager.js#L210-L216 · Note
• https://t.me/cvenotify/53699 · Telegram Post