## Summary
UptimeFlare (serverless uptime monitoring & status pages on Cloudflare Workers) exposed sensitive configuration via a client-side bundle. In affected versions, workerConfig was imported into pages/incidents.tsx client component code, causing secrets (e.g., tokens, webhook URLs, internal monitor targets) to be retrievable by any visitor.
## Technical Details
- Root cause: uptime.config.ts exports both pageConfig (client-safe) and workerConfig (server-only), but pages/incidents.tsx imported and used workerConfig directly in client-side component code.
- Result: the entire workerConfig object was included in the JavaScript bundle served to all visitors.
- Exploitation: an attacker can open browser DevTools, inspect the page’s JavaScript bundle, and extract the full contents of workerConfig.
- Exposed data may include:
- internal hostnames/IPs and TCP port targets for monitors
- HTTP Authorization headers and custom headers/bodies (e.g., API tokens/Bearer tokens)
- notification webhook URLs containing embedded secrets (e.g., Telegram Bot API tokens, Discord webhook URLs)
- webhook payload contents (e.g., chat IDs)
- Patch: commit 377a596 removes the direct import of workerConfig and accesses it exclusively via dynamic import() inside getServerSideProps, plus adds an ESLint rule to prevent misuse.
## Affected
- lyc8503 uptimeflare versions between 2025-09-21 and 2026-03-04 (inclusive of the affected window described), prior to fix commit 377a596.
## Impact
- High confidentiality impact: sensitive monitor targets and notification credentials can be extracted by any user who loads the page.
- Potential credential compromise: exposed API tokens/webhook secrets should be treated as compromised.
## Mitigation
1. Upgrade to a version containing fix commit 377a596 (patched 2026-03-04).
2. After upgrading, rotate any credentials that were previously exposed in workerConfig (API tokens, webhook URLs, secrets).
3. If immediate upgrade is not possible, remove all sensitive values from workerConfig (tokens/passwords/webhook URLs) as a temporary containment measure.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE-200