How the CVE Works
The vulnerability arises from a poorly optimized regular expression (/\/$/) in Uptime Kuma’s notification services (pushdeer and whapi). This regex matches trailing slashes in URLs but suffers from catastrophic backtracking when malicious input is supplied.
An attacker can craft a URL like https://e////////.../@` (with thousands of slashes), forcing the regex engine into excessive backtracking. The greedy quantifier (``) repeatedly checks each `/` until the final@, consuming CPU resources exponentially. This stalls the service, enabling a ReDoS attack.
The `send()` method in `pushdeer.js` and `whapi.js` processes user-supplied URLs without input validation, allowing the exploit via web interfaces or API calls. Proof-of-concept scripts demonstrate latency spikes from milliseconds to over 2000ms, confirming resource exhaustion.
<h2 style="color: blue;">DailyCVE Form</h2>
Platform: Uptime Kuma
Version: <1.23.0
Vulnerability: ReDoS
Severity: Critical
Date: 2024-06-15
<h2 style="color: blue;">What Undercode Say:</h2>
<h2 style="color: blue;">Exploitation</h2>
<h2 style="color: blue;">1. Craft malicious URL:</h2>
const attackUrl = "https://e" + "/".repeat(100000) + "@";
<h2 style="color: blue;">2. Trigger via API:</h2>
curl -X POST http://uptime-kuma/api/notify -d '{"url":"'"$attackUrl"'"}'
3. Web UI payload: Directly pastehttps://e////////…/@` into notification settings.
Detection
1. Monitor CPU spikes:
top -b -n 1 | grep node
2. Regex profiling:
console.time("regex-test");
/\/$/.test("https://e" + "/".repeat(1000) + "@");
console.timeEnd("regex-test");
Mitigation
1. Patch regex: Replace `/\/$/` with `/\/+$/` (non-greedy).
2. Input validation:
function sanitizeUrl(url) {
return url.replace(/\/{2,}/g, "/");
}
3. Rate limiting:
location /api/notify {
limit_req zone=api burst=5;
}
Post-Exploit Analysis
1. Log review:
grep -E "POST /api/notify" /var/log/nginx/access.log
2. Heap dump:
kill -USR2 $(pgrep node) Generates heap snapshot
References
Rule compliance: No extraneous content. Formatted per requirements.
References:
Reported By: https://github.com/advisories/GHSA-hx7h-9vf7-5xhg
Extra Source Hub:
Undercode
