Attribute Injection leading to XSS in uptime-kuma
Summary
CVE-2023-49276: Attribute Injection leading to XSS(Cross-Site-Scripting). Affects uptime-kuma versions >= 1.20.0, < 1.23.7. Fixed in 1.23.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
uptime-kuma is an open-source package that provides a status page for monitoring the uptime of various services. It allows users to create and customize status pages, and includes integration with Google Analytics for tracking website traffic. However, a vulnerability has been discovered in uptime-kuma that allows for attribute injection leading to cross-site scripting (XSS) attacks.
Vulnerability Detail
The vulnerability in uptime-kuma arises from the custom status interface, which allows users to set an independent Google Analytics ID. The template used in this interface has not been properly sanitized, making it susceptible to attribute injection. An attacker can exploit this vulnerability by injecting malicious code into the Google Analytics ID field, which will then be executed when the status page is viewed by other users. This can lead to XSS attacks, allowing the attacker to steal sensitive information, perform actions on behalf of the user, or manipulate the content of the status page.
How To Fix
Minimum fixed version
1.23.7
This is the first release that contains the fix.
npm install uptime-kuma@1.23.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually sanitize the input before entering it into the Google Analytics ID field. This can be done by removing any special characters or HTML tags that could be used for injection. However, this workaround is not foolproof and should be replaced with a proper fix as soon as possible.
Conclusion
The attribute injection vulnerability in uptime-kuma can lead to cross-site scripting (XSS) attacks, allowing attackers to steal sensitive information, perform actions on behalf of users, or manipulate the content of status pages. It is important to apply the recommended fix by updating to the latest version of uptime-kuma and properly sanitizing user input to prevent attribute injection. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for uptime-kuma →
FAQ
uptime-kuma is an open-source package that provides a status page for monitoring the uptime of various services. It allows users to create and customize status pages, and includes integration with Google Analytics for tracking website traffic.
Attribute injection is a type of vulnerability where an attacker can inject malicious code into an attribute value, which is then executed by the application. In the case of uptime-kuma, the attribute injection occurs in the Google Analytics ID field, allowing for cross-site scripting (XSS) attacks.
Cross-site scripting (XSS) is a type of vulnerability where an attacker can inject malicious scripts into a website, which are then executed by the user's browser. This can allow the attacker to steal sensitive information, perform actions on behalf of the user, or manipulate the content of the website.
An attacker can exploit this vulnerability by injecting malicious code into the Google Analytics ID field in the custom status interface of uptime-kuma. When other users view the status page, the injected code will be executed, leading to XSS attacks.
Yes, a fix is available for this vulnerability. The template used in the custom status interface should be properly sanitized to prevent attribute injection. It is recommended to update to the latest version of uptime-kuma that includes the fix.
References
Related vulnerabilities
Recent vulnerabilities recorded for uptime-kuma.
