GHSA-23q2-5gf8-gjpp Enabling Authentication does not close all logged in socket connections immediately
Enabling authentication in Uptime Kuma fails to invalidate existing sessions, allowing unauthorized access to previously authenticated users.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-23q2-5gf8-gjpp?
GHSA-23q2-5gf8-gjpp is an authentication bypass vulnerability in uptime-kuma, published on 19 Apr 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Summary
This is basically GHSA-88j4-pcx8-q4q but instead of changing passwords, when enabling authentication.
PoC
- Open Uptime Kuma with authentication disabled
- Enable authentication using another window
- Access the platform using the previously logged-in window
- Note that access (read-write) remains despite the enabled authentication
- Expected behaviour:
- After enabling authentication, all previously connected sessions should be invalidated, requiring users to log in.
- Actual behaviour:
- The system retains sessions and never logs out users unless explicitly done by clicking logout or refreshing the page.
Impact
See GHSA-g9v2-wqcj-j99g and GHSA-88j4-pcx8-q4q
TBH this is quite a niche edge case, so I don't know if this even warrants a security report.
Which versions are affected by GHSA-23q2-5gf8-gjpp?
2 open source packages ship an affected version, including uptime-kuma.
| Package | Affected | Fixed in |
|---|---|---|
uptime-kuma npm | All versions | 1.23.12 |
uptime-kuma npm | All versions | 1.23.12 |
How do I fix GHSA-23q2-5gf8-gjpp?
Upgrade uptime-kuma to 1.23.12 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is GHSA-23q2-5gf8-gjpp being exploited?
There is no known exploitation of GHSA-23q2-5gf8-gjpp in the wild and no public exploit code.