CVE-2024-29194: OneUptime Privilege Escalation Vulnerability

CVE-2024-29194 Overview

CVE-2024-29194 is a broken access control vulnerability in OneUptime, an open-source platform for monitoring and managing online services. The application relies on a client-side flag, is_master_admin, stored in the browser's local storage to determine administrative status. An authenticated attacker can modify this key from false to true and gain administrative privileges because the server does not independently validate the claim. The issue is tracked under [CWE-639: Authorization Bypass Through User-Controlled Key] and has been resolved in OneUptime version 7.0.1815.

Critical Impact
Any authenticated low-privileged user can elevate to master administrator by tampering with a browser local storage value, exposing all tenant data and configuration.

Affected Products

Hackerbay OneUptime prior to 7.0.1815
OneUptime self-hosted deployments using the vulnerable web client
OneUptime SaaS instances that had not been updated before the patch

Discovery Timeline

2024-03-24 - CVE-2024-29194 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-29194

Vulnerability Analysis

The OneUptime web application stores an is_master_admin boolean in the browser's local storage after authentication. Client-side code reads this value to render administrative interfaces and permit privileged actions. Because local storage is fully controllable by the user, the flag cannot be trusted as an authorization signal.

The backend API endpoints did not re-validate whether the requesting session actually belonged to a master administrator. An attacker only needed to change the stored value in a browser developer console and reload the application. Subsequent requests were treated as administrator actions, allowing full access to tenant configuration, monitors, incidents, and user management.

This pattern falls under [CWE-639] because authorization decisions are made using a client-supplied key rather than a server-verified role claim tied to the session.

Root Cause

The root cause is missing server-side authorization enforcement. The application design conflated UI state (what to render) with security state (what to allow). The server accepted privileged operations without re-checking the caller's role against the authoritative user record.

Attack Vector

Exploitation requires network access to the OneUptime web interface and a valid low-privileged account. The attacker opens browser developer tools, sets localStorage.setItem('is_master_admin', 'true'), and refreshes the page. Administrative endpoints then respond as if the account were a master administrator.

typescript

// Excerpt from the security patch in
// CommonServer/Types/Database/ModelPermission.ts
 import ColumnBillingAccessControl from 'Common/Types/BaseDatabase/ColumnBillingAccessControl';
 import DatabaseCommonInteractionPropsUtil from 'Common/Types/BaseDatabase/DatabaseCommonInteractionPropsUtil';
 import Includes from 'Common/Types/BaseDatabase/Includes';
+import UserModel from 'Common/Models/UserModel';

 export interface CheckReadPermissionType<TBaseModel extends BaseModel> {
     query: Query<TBaseModel>;

Source: OneUptime commit 14016d23. The patch introduces server-side user model checks and tightens permission evaluation so that role decisions are derived from the authenticated session rather than client-supplied state.

Detection Methods for CVE-2024-29194

Indicators of Compromise

Non-administrative accounts issuing requests to administrative API paths shortly after login
Sudden creation, modification, or deletion of tenants, projects, or user roles by accounts without prior administrative history
Audit log entries showing privileged actions performed by users whose stored role in the database is not master administrator

Detection Strategies

Correlate application audit logs with the authoritative user role field in the OneUptime database to flag privileged actions performed by non-admin accounts
Inspect web proxy or WAF logs for administrative endpoint access from sessions that lack the corresponding server-side role
Alert on client-side manipulation patterns such as repeated logins followed immediately by privileged API calls

Monitoring Recommendations

Enable verbose audit logging on OneUptime and forward events to a centralized log platform for retention and correlation
Baseline normal administrative activity per account and alert on deviations
Review the GitHub Security Advisory GHSA-246p-xmg8-wmcq for vendor-specific detection guidance

How to Mitigate CVE-2024-29194

Immediate Actions Required

Upgrade OneUptime to version 7.0.1815 or later on all self-hosted and containerized deployments
Review the audit log for privileged actions performed by accounts that are not master administrators and revert unauthorized changes
Rotate credentials, API keys, and secrets that may have been exposed to a tampered session

Patch Information

The vulnerability is fixed in OneUptime 7.0.1815. The change is committed in OneUptime commit 14016d23 and documented in GitHub Security Advisory GHSA-246p-xmg8-wmcq. The fix enforces server-side permission checks by resolving the caller's user model rather than trusting client-provided role flags.

Workarounds

Restrict access to the OneUptime web interface to trusted networks or VPN users until the patch is applied
Temporarily disable self-service account registration to limit the pool of authenticated users who could attempt exploitation
Monitor administrative endpoints with a reverse proxy rule that denies requests from sessions lacking a validated admin cookie or header

bash

# Example: pull and deploy the patched OneUptime release
git fetch --tags
git checkout release/7.0.1815
docker compose pull
docker compose up -d

# Verify the running version
curl -s https://oneuptime.example.com/status | grep version