OneUptime Synthetic Monitor RCE via exposed Playwright browser object

Root

Cause

The vulnerability lies in OneUptime's Synthetic Monitor feature, where low-privileged project users can submit custom Playwright code that is executed on the oneuptime-probe service. This code runs inside Node's vm module but is given access to live Playwright objects such as browser and page. This exposure creates a distinct server-side RCE primitive: attackers can directly use the injected browser object to call browser.browserType().launch(...) and spawn arbitrary executables on the probe host or container, bypassing traditional sandbox escape techniques [1][2].

Attack

Vector

A user with Project Member permissions (or lower, depending on access controls) can create or edit a synthetic monitor and embed malicious Playwright code. The code is executed on the probe service without proper isolation, as the vm sandbox does not protect against dangerous host capabilities injected into the untrusted code. No additional authentication or network position is required beyond accessing the Synthetic Monitor creation functionality [1][2].

Impact

Successful exploitation allows an attacker to achieve remote code execution on the probe host or container. This can lead to full compromise of the monitoring infrastructure, including lateral movement within the environment, data exfiltration, and disruption of monitoring services [1][2].

Mitigation

The vulnerability is fixed in OneUptime version 10.0.20. Users are strongly advised to upgrade immediately. No known workarounds are available, as the issue stems from fundamental design choices in sandboxing untrusted code [1][2].