CVE-2023-49276: Attribute Injection leading to XSS(Cross-Site-Scripting) in uptime-kuma
First published: Fri Nov 24 2023(Updated: )
### Summary Google Analytics element Attribute Injection leading to XSS ### Details Since the custom status interface can set an independent Google Analytics ID and the template has not been sanitized, there is an attribute injection vulnerability here, which can lead to XSS attacks.  ### PoC 1. Run the latest version of the louislam/uptime-kuma container and initialize the account password. 2. Create a new status page. 3. Edit the status page and change the Google Analytics ID to following payload(it only works for firefox. Any attribute can be injected, but this seems the most intuitive): ``` 123123" onafterscriptexecute=alert(window.name+1),eval(window.name) a="x ``` 4. Click Save and return to the interface. XSS occurs. screenshots:  
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| npm/uptime-kuma | >=1.20.0<=1.23.6 | 1.23.7 |
| Uptime Kuma | >=1.20.0<1.23.7 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2023-49276.
What is the severity of CVE-2023-49276?
The severity of CVE-2023-49276 is medium with a CVSS score of 6.3.
What is the affected software?
The affected software is uptime-kuma version 1.20.0 to 1.23.6.
How can the attribute injection vulnerability in uptime-kuma be exploited?
The attribute injection vulnerability in uptime-kuma can be exploited by setting an independent Google Analytics ID in the custom status interface.
How can the attribute injection vulnerability in uptime-kuma be fixed?
The attribute injection vulnerability in uptime-kuma can be fixed by updating to version 1.23.7 of the software.
- collector/github-advisory-latest
- alias/GHSA-v4v2-8h88-65qj
- alias/CVE-2023-49276
- agent/references
- agent/type
- agent/first-publish-date
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/remedy
- agent/last-modified-date
- agent/weakness
- agent/severity
- agent/title
- agent/description
- agent/event
- agent/trending
- agent/source
- agent/tags
- collector/nvd-api
- agent/software-canonical-lookup-request
- collector/nvd-cve
- agent/author
- package-manager/npm
- vendor/uptime.kuma
- canonical/uptime kuma
- version/uptime kuma/1.20.0