GHSA-23q2-5gf8-gjpp

Source

https://github.com/advisories/GHSA-23q2-5gf8-gjpp

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/04/GHSA-23q2-5gf8-gjpp/GHSA-23q2-5gf8-gjpp.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-23q2-5gf8-gjpp

Published

2024-04-19T17:26:32Z

Modified

2024-04-19T17:26:32Z

Summary

Enabling Authentication does not close all logged in socket connections immediately

Details

Summary

This is basically GHSA-88j4-pcx8-q4q but instead of changing passwords, when enabling authentication.

PoC

Open Uptime Kuma with authentication disabled
Enable authentication using another window
Access the platform using the previously logged-in window
Note that access (read-write) remains despite the enabled authentication
Expected behaviour:
- After enabling authentication, all previously connected sessions should be invalidated, requiring users to log in.
Actual behaviour:
- The system retains sessions and never logs out users unless explicitly done by clicking logout or refreshing the page.

Impact

See GHSA-g9v2-wqcj-j99g and GHSA-88j4-pcx8-q4q

TBH this is quite a niche edge case, so I don't know if this even warrants a security report.

Database specific

{
    "github_reviewed_at": "2024-04-19T17:26:32Z",
    "cwe_ids": [
        "CWE-384"
    ],
    "nvd_published_at": null,
    "severity": "LOW",
    "github_reviewed": true
}

References

Affected packages

npm / uptime-kuma

Package

Name: uptime-kuma; View open source insights on deps.dev
Purl: pkg:npm/uptime-kuma

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.23.12

Database specific

{
    "last_known_affected_version_range": "<= 1.23.11"
}