CVE-2023-44400: Uptime Kuma Persistent User Sessions
Summary
CVE-2023-44400: Uptime Kuma has Persistentent User Sessions. Affects uptime-kuma versions < 1.23.3. Fixed in 1.23.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Uptime Kuma is an open-source monitoring tool that sets JWT tokens for users after successful authentication. These tokens are stored in either sessionStorage or localStorage, depending on the 'Remember Me' button selection. However, the tokens lack proper verification after password changes or periods of inactivity, leading to persistent account access. This vulnerability poses a significant security risk as it allows attackers with local access to a user's device to hijack their session indefinitely.
Vulnerability Detail
The vulnerability in Uptime Kuma arises from the design flaws in the JWT tokens. Firstly, the tokens remain valid without any time limitation, even after long periods of inactivity. This increases the risk of session hijacking if a user forgets to log off and leaves their PC unattended. Secondly, sessions are only deleted on the client side after a user logs out, enabling a local attacker with deep system access to reuse the token. Additionally, changing a password does not log out previously logged-in clients, and previously issued tokens remain valid forever. These flaws allow user cookies to remain valid even after changing passwords or being inactive, posing a high security risk.
How To Fix
Minimum fixed version
1.23.3
This is the first release that contains the fix.
npm install uptime-kuma@1.23.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually log out after each session and avoid leaving their devices unattended. Additionally, users can clear their browser's sessionStorage or localStorage to remove any stored tokens.
Conclusion
The Uptime Kuma vulnerability allows attackers with local access to a user's device to gain persistent account access, posing significant risks to confidentiality, availability, and integrity. It is crucial for Uptime Kuma users to update to the latest version (1.23.3) to mitigate this vulnerability. Regular session audits and token expiration checks are recommended to detect potential instances of session hijacking. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for uptime-kuma →
FAQ
The vulnerability allows an attacker with local access to a user's device to gain permanent account access, even after hours of previous inactivity or a password change. This can lead to confidentiality, availability, and integrity loss, as well as potential scope creep if the attacker can access other infrastructure.
By gaining access to a user's device, an attacker can reuse the valid user cookie or token stored in sessionStorage or localStorage. This allows them to impersonate the user and perform actions with their account privileges, such as accessing confidential information, modifying settings, or causing availability issues.
Yes, this vulnerability can be detected by monitoring user sessions and identifying tokens that remain valid even after password changes or long periods of inactivity. Regular session audits and token expiration checks can help identify potential instances of session hijacking.
Yes, a fix has been released in version 1.23.3 of the Uptime Kuma package. Users are advised to update to the latest version to mitigate the vulnerability.
As mentioned earlier, users can manually log out after each session and clear their browser's sessionStorage or localStorage to remove any stored tokens. However, these workarounds are temporary and do not address the underlying vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for uptime-kuma.
