Nixpkgs security tracker
6.8 MEDIUM
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): High (H)
- Privileges Required (PR): None (N)
- User Interaction (UI): Required (R)
- Scope (S): Unchanged (U)
- Confidentiality (C): High (H)
- Integrity (I): High (H)
- Availability (A): None (N)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): High (H)
- Modified Privileges Required (MPR): None (N)
- Modified User Interaction (MUI): Required (R)
- Modified Confidentiality (MC): High (H)
- Modified Scope (MS): Unchanged (U)
- Modified Integrity (MI): High (H)
- Modified Availability (MA): None (N)
by @LeSuisse Activity log
- Created suggestion
-
@LeSuisse
ignored
4 packages
- nezha-agent
- nezha-theme-user
- nezha-theme-admin
- nezha-theme-nazhua
- @LeSuisse accepted
- @LeSuisse published on GitHub
Nezha Monitoring: OAuth2 Redirect URL — Host Header Injection
Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.0.0 to before version 2.2.0, the getRedirectURL function in oauth2.go:22-29 constructs the OAuth2 callback URL by concatenating the request's Host header with a fixed path, with zero validation of the Host header. This can result in host header injection. This issue has been patched in version 2.2.0.
References
-
https://github.com/nezhahq/nezha/security/advisories/GHSA-9rc6-8cjv-rcvx x_refsource_CONFIRM
Affected products
- ==>= 1.0.0, < 2.2.0
Matching in nixpkgs
Ignored packages (4)
pkgs.nezha-agent
Agent of Nezha Monitoring
pkgs.nezha-theme-user
Nezha monitoring user frontend based on next.js
pkgs.nezha-theme-admin
Nezha monitoring admin frontend
6.5 MEDIUM
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): Low (L)
- Privileges Required (PR): Low (L)
- User Interaction (UI): None (N)
- Scope (S): Unchanged (U)
- Confidentiality (C): None (N)
- Integrity (I): None (N)
- Availability (A): High (H)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): Low (L)
- Modified Privileges Required (MPR): Low (L)
- Modified User Interaction (MUI): None (N)
- Modified Confidentiality (MC): None (N)
- Modified Scope (MS): Unchanged (U)
- Modified Integrity (MI): None (N)
- Modified Availability (MA): High (H)
by @LeSuisse Activity log
- Created suggestion
-
@LeSuisse
ignored
4 packages
- nezha-agent
- nezha-theme-user
- nezha-theme-admin
- nezha-theme-nazhua
- @LeSuisse accepted
- @LeSuisse published on GitHub
Nezha Monitoring: Authenticated users can claim the dashboard Host through NAT and preempt all dashboard routing
Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 2.0.14 to before version 2.1.0, authenticated users can claim the dashboard Host through NAT and preempt all dashboard routing. This issue has been patched in version 2.1.0.
References
-
https://github.com/nezhahq/nezha/security/advisories/GHSA-x6fg-52vr-hj4w x_refsource_CONFIRM
Affected products
- ==>= 2.0.14, < 2.1.0
Matching in nixpkgs
Ignored packages (4)
pkgs.nezha-agent
Agent of Nezha Monitoring
pkgs.nezha-theme-user
Nezha monitoring user frontend based on next.js
pkgs.nezha-theme-admin
Nezha monitoring admin frontend
6.5 MEDIUM
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): Low (L)
- Privileges Required (PR): Low (L)
- User Interaction (UI): None (N)
- Scope (S): Unchanged (U)
- Confidentiality (C): None (N)
- Integrity (I): None (N)
- Availability (A): High (H)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): Low (L)
- Modified Privileges Required (MPR): Low (L)
- Modified User Interaction (MUI): None (N)
- Modified Confidentiality (MC): None (N)
- Modified Scope (MS): Unchanged (U)
- Modified Integrity (MI): None (N)
- Modified Availability (MA): High (H)
by @LeSuisse Activity log
- Created suggestion
-
@LeSuisse
ignored
4 packages
- nezha-agent
- nezha-theme-user
- nezha-theme-admin
- nezha-theme-nazhua
- @LeSuisse accepted
- @LeSuisse published on GitHub
Nezha Monitoring: Unbounded WebSocket Streams — Resource Exhaustion DoS
Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.0.0 to before version 2.2.0, the Nezha dashboard exposes two endpoints that create long-lived WebSocket streams to monitored agents: POST /api/v1/terminal → createTerminal() (terminal.go:27-67) and POST /api/v1/file → createFM() (fm.go:28-67). Both call rpc.NezhaHandlerSingleton.CreateStream(streamId, ...) which inserts a new ioStreamContext into an unbounded map[string]*ioStreamContext (s.ioStreams in io_stream.go:59-67). There is no per-user rate limit, no global semaphore, and no per-server connection cap. This issue has been patched in version 2.2.0.
References
-
https://github.com/nezhahq/nezha/security/advisories/GHSA-jg62-j5h6-8mpq x_refsource_CONFIRM
Affected products
- ==>= 1.0.0, < 2.2.0
Matching in nixpkgs
Ignored packages (4)
pkgs.nezha-agent
Agent of Nezha Monitoring
pkgs.nezha-theme-user
Nezha monitoring user frontend based on next.js
pkgs.nezha-theme-admin
Nezha monitoring admin frontend