Summary
Uptime Kuma's Matomo analytics integration places an administrator-configurable site identifier into a JavaScript block without adequately preserving the surrounding expression context. If a privileged user stores crafted content, arbitrary JavaScript may execute in the browser of every visitor who views the affected public status page.
Affected context
The issue occurs in Uptime Kuma deployments that enable the Matomo analytics integration and publish public status pages. It becomes risky when a user with permission to configure analytics can store a site identifier that is later rendered into a script block viewed by unauthenticated visitors.
Exploit preconditions
- Attack surface: Public status pages containing the Matomo analytics script
- Required access: Permission to configure or save the Matomo site identifier
- Trigger point: A visitor loads a public
/status/<slug>page - Why exploitation is possible: The configured value is inserted into a JavaScript expression, and the escaping pipeline does not neutralize all characters needed to leave that expression context
Why this happens
The vulnerability is caused by placing an administrator-controlled value directly into executable JavaScript rather than treating it strictly as data. The applied escaping is insufficient for the JavaScript expression context, allowing stored input to alter the script's structure and execute additional code when the page is rendered. This maps to CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), specifically a stored XSS condition.
Potential impact
- An attacker-controlled script may execute in visitors' browsers
- Session information or accessible authentication material could be exposed
- Public status pages may be modified or visually replaced
- User actions and page content could be manipulated
- The issue could support further attacks against administrators or visitors
General mitigation guidance
Mitigation generally focuses on keeping configuration values out of executable script contexts and reducing trust in administrative input.
Common defensive patterns include:
- Passing analytics identifiers through structured data or DOM properties rather than JavaScript source concatenation
- Applying context-specific, allowlist-based validation for identifiers that should contain only a narrow format
- Using safe serialization that produces valid JavaScript literals without permitting expression changes
- Enforcing a strong Content Security Policy that limits script execution and reduces inline-script reliance
- Restricting analytics configuration privileges and protecting administrative sessions with least privilege
- Applying output encoding appropriate to the exact rendering context
How teams detect issues like this
Organizations can look for this class of issue through:
- Static analysis rules identifying user-controlled values concatenated into script blocks
- Code review checks for JavaScript construction through string interpolation
- Tests using boundary characters and unexpected expression delimiters in configuration fields
- Verification that identifiers are validated by a strict allowlist before storage and rendering
- Content Security Policy reporting and browser telemetry for unexpected script execution on public pages
- Automated application-security review tools that track stored input from administrative forms to browser sinks
