Uptime Kuma Regular Expression Denial-of-Service Vulnerability

A regular expression denial-of-service (ReDoS) vulnerability has been identified in Uptime Kuma versions through 1.23.0. This issue arises when an administrator creates a notification via the web service. The vulnerability is triggered by a string that causes catastrophic backtracking in the regular expression used to match URL endings, leading to excessive CPU resource consumption.

Impact

Exploitation of this vulnerability causes high CPU usage and application lag, disrupting normal business logic processes.

Reproduction

The vulnerability can be reproduced by sending a notification through the PushDeer or Whapi notification providers with a crafted URL that includes a large number of slashes followed by a non-slash character. This input causes the regular expression to enter a backtracking loop, checking each slash and consuming significant CPU resources.

Remediation

Users can update to Uptime Kuma version 1.23.1 or later, where this vulnerability has been fixed.