Uptime Kuma vulnerable to authenticated remote code execution via malicious plugin installation

CVE-2023-36821

What is CVE-2023-36821?

Uptime Kuma, a self-hosted monitoring tool by Louis Lam, is susceptible to remote code execution due to an authentication flaw that allows attackers to install malicious plugins in versions before 1.22.1. Although the ability to install plugins is currently disabled via the web interface, the API endpoints remain accessible to authenticated users. This vulnerability arises as the plugin installation process does not verify the plugin against an official list, nor does it prevent the execution of potentially dangerous npm scripts. This oversight is critical since it allows the execution of arbitrary code on the server. Users are advised to upgrade to version 1.22.1, which has released a patch addressing this issue.

References