Summary

The socket message getPushExample is vulnerable to unauthenticated requests, and allows for a path traversal which leads to the leakage of a file that begins with index..

Details

This code is vulnerable to unauthenticated requests, and allows for a path traversal which leads to the leakage of a file that begins with index..

    socket.on("getPushExample", (language, callback) => {

        try {
            let dir = path.join("./extra/push-examples", language);
            let files = fs.readdirSync(dir);

            for (let file of files) {
                if (file.startsWith("index.")) {
                    callback({
                        ok: true,
                        code: fs.readFileSync(path.join(dir, file), "utf8"),
                    });
                    return;
                }
            }
        } catch (e) {

        }

        callback({
            ok: false,
            msg: "Not found",
        });
    });

By using an unauthenticated session, it is possible to request this endpoint as checkLogin(socket); is not called. Furthermore, language could be a path with a path traversal (../) which could read files in other directories.

PoC

By sending the following payload 420["getPushExample","../../"], we can obtain Uptime Kuma's index.html file.

This is in BurpSuite, but it can also be accomplished natively in JS.

Steps:

1. Set a breakpoint in login() to capture the socket object
   

2. Call emit with getPushExample and the path. For example: SOCK.emit("getPushExample", '../../', (res) => { console.log(res); });
   

Impact

This vulnerability has very low impact, as the file must be named index.*. However, as it is a common filename, some sensitive files could be leaked leading to more issues.

The CVSS I calculated was like so: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N