CVE-2024-29194: 
JavaScript vulnerability analysis and mitigation

CVE-2024-29194 affects OneUptime, a solution for monitoring and managing online services. The vulnerability was discovered on March 24, 2024, and involves improper validation of client-side stored data within the web application. Specifically, the vulnerability allows an authenticated user to manipulate the is_master_admin key stored in the browser's local storage to escalate their privileges (GitHub Advisory). The issue has been patched in version 7.0.1815.

The vulnerability stems from insufficient server-side validation of client-side stored data. An attacker can exploit this by modifying the is_master_admin key value from false to true in the browser's local storage. The CVSS v3.1 base score is 8.3 (High), with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L. The vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key) (GitHub Advisory).

The vulnerability allows authenticated users to gain unauthorized administrative access to the system. While most administrative privileges were restricted, an attacker could access sensitive information such as the complete list of users who signed up to OneUptime. This represents a significant security risk as it compromises both confidentiality and integrity of the system (GitHub Advisory).

The vulnerability is relatively easy to exploit and requires only low privileges and no user interaction. An attacker needs only to be authenticated as a regular user and have access to browser developer tools to modify the local storage value. A proof of concept demonstrates that the exploitation can be performed using Firefox Developer Tools by accessing the Storage section and modifying the is_master_admin key (GitHub Advisory).

The vulnerability has been patched in OneUptime version 7.0.1815. Users should upgrade to this version or later to protect against this security issue (GitHub Advisory).