PT-2023-25714 · Unknown · Uptime Kuma

N-Thumann · Published 2023-07-05 · Updated 2024-05-01 · CVE-2023-36822

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Uptime Kuma versions prior to 1.22.1

Description A path traversal vulnerability allows an authenticated attacker to delete files on the server, leading to unavailability and potentially data loss. Uptime Kuma allows authenticated users to install plugins from an official list of plugins, although this feature is currently disabled in the web interface. The corresponding API endpoints are still available after login. Before a plugin is downloaded, the plugin installation directory is checked for existence, and if it exists, it's removed before the plugin installation. Because the plugin is not validated against the official list of plugins or sanitized, the check for existence and the removal of the plugin installation directory are prone to path traversal. This vulnerability enables an authenticated attacker to delete files from the server Uptime Kuma is running on, potentially causing Uptime Kuma or the whole system to become unavailable due to data loss.

Recommendations For versions prior to 1.22.1, update to version 1.22.1 or later to resolve the issue. As a temporary workaround, consider disabling the plugin installation feature until a patch is available. Restrict access to the API endpoints related to plugin installation to minimize the risk of exploitation. Avoid using the plugin installation directory in a way that could lead to path traversal until the issue is resolved.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2023-36822

GHSA-VR8X-74PM-6VJ7

Affected Products

Uptime Kuma

References · 11

• 🔥 https://github.com/louislam/uptime-kuma/security/advisories/GHSA-vr8x-74pm-6vj7 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/36xxx/CVE-2023-36822.json · Exploit
• https://github.com/louislam/uptime-kuma/pull/3346 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-36822 · Security Note
• https://osv.dev/vulnerability/GHSA-vr8x-74pm-6vj7 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-36822 · Vendor Advisory
• https://github.com/louislam/uptime-kuma · Note
• https://github.com/louislam/uptime-kuma/blob/de74efb2e6601dcbcfed32cddefc4078a80fcb0b/server/plugins-manager.js#L75-L80 · Note
• https://github.com/louislam/uptime-kuma/commit/a0736e04b2838aae198c2110db244eab6f87757b · Note
• https://github.com/louislam/uptime-kuma/releases/tag/1.22.1 · Note
• https://t.me/cvenotify/53698 · Telegram Post