CVE-2024-29194: OneUptime Vulnerable to a Privilege Escalation via Local Storage Key Manipulation
Summary A security vulnerability exists in oneuptime's local storage handling, where a regular user can escalate privileges by modifying the ismasteradmin key to true. This allows unauthorized access to administrative functionalities.
Details The vulnerability lies in the improper validation of client-side stored data within the web application. Specifically, the ismasteradmin key, stored in the local storage of the browser, can be manipulated by an attacker. By changing this key from false to true, the application grants administrative privileges to the user, without proper server-side validation.
POC (I am using Firefox Developer to demonstrate this vulnerability) Log in as a normal user. Open developer tools (hit F12), click Storage, then Local Storage. Modify the ismasteradmin key from false to true.
Impact This vulnerability represents a high security risk as it allows any authenticated user to gain administrative privileges through client-side manipulation. Most of the admin previlages were disabled except the user list. Where an attacker could see all the list of users who signed up to OneUptome.
Patch This has been patched in 7.0.1815
Other sources
OneUptime is a solution for monitoring and managing online services. The vulnerability lies in the improper validation of client-side stored data within the web application. Specifically, the ismasteradmin key, stored in the local storage of the browser, can be manipulated by an attacker. By changing this key from false to true, the application grants administrative privileges to the user, without proper server-side validation. This has been patched in 7.0.1815.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/@oneuptime/common-serverto a version that resolves this vulnerability.Fixed in 7.0.1815 - Upgrade
Upgrade
npm/@oneuptime/modelto a version that resolves this vulnerability.Fixed in 7.0.1815 - Upgrade
Upgrade
OneUptimeto a version that resolves this vulnerability.Fixed in 7.0.1815
Event History
Frequently Asked Questions
What is the severity of CVE-2024-29194?
CVE-2024-29194 is classified as a high-severity vulnerability due to its potential for privilege escalation.
How do I fix CVE-2024-29194?
To fix CVE-2024-29194, upgrade to the patched version 7.0.1815 of the affected packages @oneuptime/common-server and @oneuptime/model.
What is the impact of CVE-2024-29194?
CVE-2024-29194 allows regular users to gain unauthorized access to administrative functionalities by modifying local storage.
Which software versions are affected by CVE-2024-29194?
CVE-2024-29194 affects versions of @oneuptime/common-server and @oneuptime/model prior to 7.0.1815.
Who can exploit CVE-2024-29194?
CVE-2024-29194 can be exploited by any regular user who can manipulate local storage within the affected applications.