x/vulndb: potential Go vuln in github.com/louislam/uptime-kuma: CVE-2023-36821

[GoVulnBot]

CVE-2023-36821 references github.com/louislam/uptime-kuma, which may be a Go module.

Description:
Uptime Kuma, a self-hosted monitoring tool, allows an authenticated attacker to install a maliciously crafted plugin in versions prior to 1.22.1, which may lead to remote code execution. Uptime Kuma allows authenticated users to install plugins from an official list of plugins. This feature is currently disabled in the web interface, but the corresponding API endpoints are still available after login. After downloading a plugin, it's installed by calling npm install in the installation directory of the plugin. Because the plugin is not validated against the official list of plugins or installed with npm install --ignore-scripts, a maliciously crafted plugin taking advantage of npm scripts can gain remote code execution. Version 1.22.1 contains a patch for this issue.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2023-36821
• JSON: https://github.com/CVEProject/cvelist/tree/cf2df13dcd23fff2b9118fff5c814d4a7b7c8d9c/2023/36xxx/CVE-2023-36821.json
• advisory: GHSA-7grx-f945-mj96
• fix: Drop unused code louislam/uptime-kuma#3346
• web: https://github.com/louislam/uptime-kuma/blob/8c60e902e1c76ecbbd1b0423b07ce615341cb850/server/plugins-manager.js#L210-L216
• web: https://github.com/louislam/uptime-kuma/releases/tag/1.22.1
• Imported by: https://pkg.go.dev/github.com/louislam/uptime-kuma?tab=importedby

Cross references:
No existing reports found with this module or alias.

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: github.com/louislam/uptime-kuma
      vulnerable_at: 0.0.0-20230705130302-19873e5b9e06
      packages:
        - package: uptime-kuma
description: |-
    Uptime Kuma, a self-hosted monitoring tool, allows an authenticated attacker to
    install a maliciously crafted plugin in versions prior to 1.22.1, which may lead
    to remote code execution. Uptime Kuma allows authenticated users to install
    plugins from an official list of plugins. This feature is currently disabled in
    the web interface, but the corresponding API endpoints are still available after
    login. After downloading a plugin, it's installed by calling `npm install` in
    the installation directory of the plugin. Because the plugin is not validated
    against the official list of plugins or installed with `npm install
    --ignore-scripts`, a maliciously crafted plugin taking advantage of npm scripts
    can gain remote code execution. Version 1.22.1 contains a patch for this issue.
cves:
    - CVE-2023-36821
references:
    - advisory: https://github.com/louislam/uptime-kuma/security/advisories/GHSA-7grx-f945-mj96
    - fix: https://github.com/louislam/uptime-kuma/pull/3346
    - web: https://github.com/louislam/uptime-kuma/blob/8c60e902e1c76ecbbd1b0423b07ce615341cb850/server/plugins-manager.js#L210-L216
    - web: https://github.com/louislam/uptime-kuma/releases/tag/1.22.1

[gopherbot]

Change https://go.dev/cl/508456 mentions this issue: data/excluded: batch add 14 excluded reports