GHSA-23q2-5gf8-gjpp: Uptime kuma Enabling Authentication Does Not Close Vulnerability

LOW
Share
CWE-384
Published
Advisory Summary

GHSA-23q2-5gf8-gjpp is a LOW enabling authentication does not close vulnerability (CWE-384: Session Fixation) affecting Uptime kuma libraries in the npm ecosystem. The issue involves enabling authentication does not close all logged in socket connections immediately. Remediation is available by upgrading affected packages to version 1.23.12.

GHSA-23q2-5gf8-gjpp at a Glance

CVE Identifier N/A
GHSA Identifier GHSA-23q2-5gf8-gjpp
Severity LOW
CVSS v3.1 Base Score N/A
CWE Classification CWE-384: Session Fixation
Affected Product Uptime kuma
Package Ecosystem npm
Published Date
Last Updated

How to Fix GHSA-23q2-5gf8-gjpp

To remediate this vulnerability, upgrade all affected Uptime kuma dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

uptime-kuma fixed: 1.23.12 
npm install uptime-kuma@1.23.12
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

npm ls uptime-kuma

How to Check if You Are Affected

To determine whether your Node.js application is affected by GHSA-23q2-5gf8-gjpp, inspect your project dependencies using npm:

npm ls uptime-kuma

Analyze the terminal output to locate any version of Uptime kuma in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.23.12), your application is affected.

Note: The npm ls uptime-kuma command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-384: Session Fixation, where authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions. In Uptime kuma, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Summary This is basically [GHSA-88j4-pcx8-q4q](https://github.com/louislam/uptime-kuma/security/advisories/GHSA-88j4-pcx8-q4q3) but instead of changing passwords, when enabling authentication. ### PoC - Open Uptime Kuma with authentication disabled - Enable authentication using another window - Access the platform using the previously logged-in window - Note that access (read-write) remains despite the enabled authentication - Expected behaviour: - After enabling authentication, all previously connected sessions should be invalidated, requiring users to log in. - Actual behaviour: - The system retains sessions and never logs out users unless explicitly done by clicking logout or refreshing the page. ### Impact See [GHSA-g9v2-wqcj-j99g](https://github.com/louislam/uptime-kuma/security/advisories/GHSA-g9v2-wqcj-j99g) and [GHSA-88j4-pcx8-q4q](https://github.com/louislam/uptime-kuma/security/advisories/GHSA-88j4-pcx8-q4q3) TBH this is quite a niche edge case, so I don't know if this even warrants a security report.

GHSA-23q2-5gf8-gjpp Affected Uptime kuma Versions

1 component(s)
Fixed Versions:
1.23.12
Product / Package Ecosystem Affected Versions Fixed Version
uptime-kuma
npm/uptime-kuma
npm
< 1.23.12
1.23.12

References

GitHub Advisory / Wiki ADVISORY
https://github.com/louislam/uptime-kuma/security/advisories/GHSA-23q2-5gf8-gjpp
GitHub Advisory / Wiki ADVISORY
https://github.com/louislam/uptime-kuma/security/advisories/GHSA-88j4-pcx8-q4q3
GitHub Advisory / Wiki ADVISORY
https://github.com/louislam/uptime-kuma/security/advisories/GHSA-g9v2-wqcj-j99g
Security Fix Commit FIX COMMIT
https://github.com/louislam/uptime-kuma/commit/7a9e2f5de69aa0bb884ead25d1dcc833bb8c6579
Uptime kuma Source Repository REPOSITORY
https://github.com/louislam/uptime-kuma

Frequently Asked Questions

What is GHSA-23q2-5gf8-gjpp?
GHSA-23q2-5gf8-gjpp is a security vulnerability in Uptime kuma involving Enabling Authentication does not close all logged in socket connections immediately under CWE-384: Session Fixation.
Which Uptime kuma versions are affected?
Affected versions include releases prior to 1.23.12 across affected packages: uptime-kuma.
What version fixes GHSA-23q2-5gf8-gjpp?
Upgrading to 1.23.12 (or the latest patched release for your respective branch) resolves the vulnerability.
Is uptime-kuma affected?
Yes, uptime-kuma is affected in releases prior to 1.23.12. Upgrade your dependency to 1.23.12 or later.
What CWE is associated with GHSA-23q2-5gf8-gjpp?
GHSA-23q2-5gf8-gjpp is classified under CWE-384: Session Fixation (Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.).
How can I check npm dependencies for GHSA-23q2-5gf8-gjpp?
Run the dependency tree command: 'npm ls uptime-kuma'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-23q2-5gf8-gjpp",
  "modified" : "2024-04-19T17:26:32Z",
  "published" : "2024-04-19T17:26:32Z",
  "aliases" : [ ],
  "summary" : "Enabling Authentication does not close all logged in socket connections immediately ",
  "details" : "### Summary\nThis is basically [GHSA-88j4-pcx8-q4q](https://github.com/louislam/uptime-kuma/security/advisories/GHSA-88j4-pcx8-q4q3) but instead of changing passwords, when enabling authentication.\n\n### PoC\n- Open Uptime Kuma with authentication disabled\n- Enable authentication using another window\n- Access the platform using the previously logged-in window\n- Note that access (read-write) remains despite the enabled authentication\n- Expected behaviour:\n  - After enabling authentication, all previously connected sessions should be invalidated, requiring users to log in.\n- Actual behaviour:\n  - The system retains sessions and never logs out users unless explicitly done by clicking logout or refreshing the page.\n\n### Impact\nSee [GHSA-g9v2-wqcj-j99g](https://github.com/louislam/uptime-kuma/security/advisories/GHSA-g9v2-wqcj-j99g) and [GHSA-88j4-pcx8-q4q](https://github.com/louislam/uptime-kuma/security/advisories/GHSA-88j4-pcx8-q4q3)\n\nTBH this is quite a niche edge case, so I don't know if this even warrants a security report.  \n",
  "severity" : [ ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "uptime-kuma"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "1.23.12"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 1.23.11"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/louislam/uptime-kuma/security/advisories/GHSA-23q2-5gf8-gjpp"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/louislam/uptime-kuma/security/advisories/GHSA-88j4-pcx8-q4q3"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/louislam/uptime-kuma/security/advisories/GHSA-g9v2-wqcj-j99g"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/louislam/uptime-kuma/commit/7a9e2f5de69aa0bb884ead25d1dcc833bb8c6579"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/louislam/uptime-kuma"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-384" ],
    "severity" : "LOW",
    "github_reviewed" : true,
    "github_reviewed_at" : "2024-04-19T17:26:32Z",
    "nvd_published_at" : null
  }
}