Bluewave Labs
Monthly
Missing role-guard middleware on three API route groups in Checkmate through v3.11.0 allows any authenticated low-privilege user to perform administrative actions reserved for admins. Authenticated user-role accounts can create maintenance windows that silence monitoring alerts across all monitors, tamper with notification channel configurations, and delete monitor check history to destroy incident evidence. No public exploit identified at time of analysis, though the vulnerability is documented in a public GitHub issue and a VulnCheck advisory, making opportunistic exploitation by insiders or compromised accounts plausible without further development effort.
Credential leakage in Bluewave Labs Checkmate versions 3.3.0 through 3.9.1 exposes HTTP Authorization secrets to unauthenticated remote visitors when the global showURL setting is enabled. The unauthenticated GET /api/v1/status-page/:url endpoint returns complete monitor objects from statusPageController.ts, including the secret field consumed by HttpProvider.ts as a bearer or basic-auth credential against monitored upstream services. Although the frontend component BaseStatusPage.tsx intentionally omits this value from the UI, the raw JSON API response delivers it in full, allowing any visitor to harvest credentials and pivot attacks against monitored infrastructure. No public exploit code has been identified at time of analysis, and the issue is fixed in v3.9.2.
Remote memory exhaustion in Bluewave Labs Checkmate prior to version 3.9.1 allows unauthenticated network attackers to crash or destabilize the Node.js backend by submitting concurrent oversized multipart uploads to the public POST /api/v1/auth/register endpoint. The in-memory Multer parser buffers uploaded files before registration validation executes, meaning no file-size, file-count, or MIME-type boundary is enforced prior to business-logic rejection - allowing attacker-controlled allocations to exhaust server RAM. No public exploit has been identified at time of analysis, though the attack requires no credentials, no special tooling, and is easily automatable against any internet-exposed deployment.
A mass assignment vulnerability in Checkmate's user profile update endpoint allows any authenticated user to escalate their privileges to superadmin level, bypassing all role-based access controls. Checkmate versions 3.5.1 and prior are affected, an open-source self-hosted server monitoring tool from Bluewave Labs. Attackers can gain complete administrative access to view all users, modify critical configurations, and access sensitive system data, though no public patches are currently available.
ReDoS (catastrophic regex backtracking) in Checkmate monitoring platform versions 3.5.1 through 3.9.1 allows an authenticated admin or superadmin to freeze the entire Node.js application for all users by supplying a malicious regular expression in an HTTP monitor's expectedValue field. The vulnerable code in AdvancedMatcher.ts evaluates the regex synchronously on the Node.js main event loop against an attacker-supplied HTTP response body with no timeout or worker isolation, causing complete availability loss. Fixed in v3.9.2 by replacing JavaScript's native RegExp with the RE2 library, which guarantees linear-time complexity. No public exploit or CISA KEV listing identified at time of analysis.
User enumeration via observable response discrepancy in Checkmate through version 2.1.0 exposes whether any given email address is registered on the platform. The password recovery endpoint POST /api/v1/auth/recovery/request returns HTTP 200 for known accounts and a distinct status code for unknown ones, allowing unauthenticated remote attackers to silently map valid user accounts. No public exploit or CISA KEV listing exists at time of analysis, but exploitation requires no authentication and is trivially automatable.
Missing role-guard middleware on three API route groups in Checkmate through v3.11.0 allows any authenticated low-privilege user to perform administrative actions reserved for admins. Authenticated user-role accounts can create maintenance windows that silence monitoring alerts across all monitors, tamper with notification channel configurations, and delete monitor check history to destroy incident evidence. No public exploit identified at time of analysis, though the vulnerability is documented in a public GitHub issue and a VulnCheck advisory, making opportunistic exploitation by insiders or compromised accounts plausible without further development effort.
Credential leakage in Bluewave Labs Checkmate versions 3.3.0 through 3.9.1 exposes HTTP Authorization secrets to unauthenticated remote visitors when the global showURL setting is enabled. The unauthenticated GET /api/v1/status-page/:url endpoint returns complete monitor objects from statusPageController.ts, including the secret field consumed by HttpProvider.ts as a bearer or basic-auth credential against monitored upstream services. Although the frontend component BaseStatusPage.tsx intentionally omits this value from the UI, the raw JSON API response delivers it in full, allowing any visitor to harvest credentials and pivot attacks against monitored infrastructure. No public exploit code has been identified at time of analysis, and the issue is fixed in v3.9.2.
Remote memory exhaustion in Bluewave Labs Checkmate prior to version 3.9.1 allows unauthenticated network attackers to crash or destabilize the Node.js backend by submitting concurrent oversized multipart uploads to the public POST /api/v1/auth/register endpoint. The in-memory Multer parser buffers uploaded files before registration validation executes, meaning no file-size, file-count, or MIME-type boundary is enforced prior to business-logic rejection - allowing attacker-controlled allocations to exhaust server RAM. No public exploit has been identified at time of analysis, though the attack requires no credentials, no special tooling, and is easily automatable against any internet-exposed deployment.
A mass assignment vulnerability in Checkmate's user profile update endpoint allows any authenticated user to escalate their privileges to superadmin level, bypassing all role-based access controls. Checkmate versions 3.5.1 and prior are affected, an open-source self-hosted server monitoring tool from Bluewave Labs. Attackers can gain complete administrative access to view all users, modify critical configurations, and access sensitive system data, though no public patches are currently available.
ReDoS (catastrophic regex backtracking) in Checkmate monitoring platform versions 3.5.1 through 3.9.1 allows an authenticated admin or superadmin to freeze the entire Node.js application for all users by supplying a malicious regular expression in an HTTP monitor's expectedValue field. The vulnerable code in AdvancedMatcher.ts evaluates the regex synchronously on the Node.js main event loop against an attacker-supplied HTTP response body with no timeout or worker isolation, causing complete availability loss. Fixed in v3.9.2 by replacing JavaScript's native RegExp with the RE2 library, which guarantees linear-time complexity. No public exploit or CISA KEV listing identified at time of analysis.
User enumeration via observable response discrepancy in Checkmate through version 2.1.0 exposes whether any given email address is registered on the platform. The password recovery endpoint POST /api/v1/auth/recovery/request returns HTTP 200 for known accounts and a distinct status code for unknown ones, allowing unauthenticated remote attackers to silently map valid user accounts. No public exploit or CISA KEV listing exists at time of analysis, but exploitation requires no authentication and is trivially automatable.