漏洞标题
时间 Kuma 缺少 WebSockets 的源验证
漏洞描述信息
Uptime Kuma 是一个易于使用的自托管监控工具。在版本1.23.9之前，应用程序使用 WebSocket(与 Socket.io 一起使用)，但它没有验证通信来源的有效性。这使得第三方网站可以代表其客户端访问应用程序。在使用 Socket.IO 连接到服务器时，服务器未验证 `Origin` 头，导致其他网站能够打开服务器的连接并与之通信。其他网站仍然需要验证以访问大部分功能，然而，这可以绕过开发人员设置的防火墙保护。
如果没有 origin 验证，来自另一个 origin 的 Javascript 将允许在没有用户交互的情况下连接到应用程序。如果没有登录凭据，这样的连接无法访问包含应用程序敏感数据的受保护端点。然而，这样的连接可能允许攻击者进一步利用应用程序 unseen 的漏洞。配置了“无授权”模式的用户提供的应用程序保护依赖的反向代理或防火墙将特别脆弱，因为它将允许攻击者访问应用程序。
在版本1.23.9中，已经将 HTTP Origin 头额外的验证添加到 Socket.io 连接处理程序中。默认情况下，如果 `Origin` 头存在，它将与 Host 头进行比较。如果主机名不匹配，连接将被拒绝，这表示请求是跨 origin。如果 `Origin` 头不存在，连接将允许。用户可以通过设置环境变量 `UPTIME_Kuma_WS_ORIGIN_CHECK=bypass` 来绕过此行为。
CVSS信息
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
漏洞类别
跨站请求伪造(CSRF)
漏洞标题
Uptime Kuma Missing Origin Validation in WebSockets
漏洞描述信息
Uptime Kuma is an easy-to-use self-hosted monitoring tool. Prior to version 1.23.9, the application uses WebSocket (with Socket.io), but it does not verify that the source of communication is valid. This allows third-party website to access the application on behalf of their client. When connecting to the server using Socket.IO, the server does not validate the `Origin` header leading to other site being able to open connections to the server and communicate with it. Other websites still need to authenticate to access most features, however this can be used to circumvent firewall protections made in place by people deploying the application.
Without origin validation, Javascript executed from another origin would be allowed to connect to the application without any user interaction. Without login credentials, such a connection is unable to access protected endpoints containing sensitive data of the application. However, such a connection may allow attacker to further exploit unseen vulnerabilities of the application. Users with "No-auth" mode configured who are relying on a reverse proxy or firewall to provide protection to the application would be especially vulnerable as it would grant the attacker full access to the application.
In version 1.23.9, additional verification of the HTTP Origin header has been added to the socket.io connection handler. By default, if the `Origin` header is present, it would be checked against the Host header. Connection would be denied if the hostnames do not match, which would indicate that the request is cross-origin. Connection would be allowed if the `Origin` header is not present. Users can override this behavior by setting environment variable `UPTIME_KUMA_WS_ORIGIN_CHECK=bypass`.
CVSS信息
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L
漏洞类别
N/A
漏洞标题
Uptime Kuma 安全漏洞
漏洞描述信息
Uptime Kuma是Louis Lam个人开发者的一个易于使用的自托管监控工具。 Uptime Kuma 1.23.9之前版本存在安全漏洞，该漏洞源于应用程序使用 WebSocket，但它不验证通信源是否有效，这将允许第三方网站代表其客户访问该应用程序。
CVSS信息
N/A
漏洞类别
其他