GHSA-c7hf-c5p5-5g6h

Summary

The GET /api/badge/:id/ping/:duration? endpoint in server/routers/api-router.js does not verify that the requested monitor belongs to a public group. All other badge endpoints check AND public = 1 in their SQL query before returning data. The ping endpoint skips this check entirely, allowing unauthenticated users to extract average ping/response time data for private monitors.

Affected Code

File: server/routers/api-router.js, approximately line 304

The ping badge endpoint directly calls UptimeCalculator.getUptimeCalculator(requestedMonitorId) without first checking if the monitor is public. Compare with the status badge endpoint (~line 148) which correctly queries:

SELECT monitor_group.monitor_id FROM monitor_group, `group`
WHERE monitor_group.group_id = `group`.id
AND monitor_group.monitor_id = ?
AND public = 1

Protected vs Vulnerable Endpoints

PoC

1. Install Uptime Kuma (tested on latest v2 stable via Docker)
2. Create an HTTP(s) monitor (e.g., monitoring http://localhost:3001)
3. Do NOT add the monitor to any public status page or group
4. Wait for heartbeats to accumulate (~5 minutes)
5. Query unauthenticated:

curl http://localhost:3001/api/badge/1/status   → returns N/A (correct, monitor is private)
curl http://localhost:3001/api/badge/1/ping/24  → returns "Avg. Ping (24h): 10ms" (LEAKED)

Impact

An unauthenticated attacker can:

• Enumerate private monitor IDs
• Extract average response time data for private monitors
• Infer existence and reachability of internal monitored services

Suggested Fix

Add the same public monitor check before the UptimeCalculator call:

let publicMonitor = await R.getRow(`
    SELECT monitor_group.monitor_id FROM monitor_group, \`group\`
    WHERE monitor_group.group_id = \`group\`.id
    AND monitor_group.monitor_id = ?
    AND public = 1
`, [requestedMonitorId]);

if (!publicMonitor) {
    badgeValues.message = "N/A";
    badgeValues.color = badgeConstants.naColor;
}