Stored Command Injection in Nezha Monitoring Agent

Mitigation Strategies

To mitigate this vulnerability, upgrade Nezha Monitoring to version 2.0.14 or later, where the issue has been patched.

Useful 0 Not Useful 0

Executive Summary

This vulnerability affects Nezha Monitoring, a self-hostable, lightweight tool for monitoring servers and websites. In versions from 1.0.0 up to but not including 2.0.14, a cross-site GET request can trigger stored cron commands on a victim's agents. This means that an attacker could cause the victim's system to execute scheduled commands by exploiting this flaw.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to unauthorized execution of stored cron commands on affected agents. This could result in an attacker manipulating system operations, potentially causing disruption or unauthorized actions on your servers or websites. The CVSS score indicates a high impact on integrity and a low impact on availability, meaning the attacker can alter system behavior but not necessarily cause a denial of service.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows unauthorized execution of existing cron commands on victim agents by abusing a cross-site request forgery (CSRF) flaw. This impacts the integrity and availability of the system by enabling attackers to trigger tasks without proper authorization.

While the provided information does not explicitly mention compliance with standards like GDPR or HIPAA, the integrity and availability impact could potentially lead to violations of such regulations if sensitive data or critical operations are affected. Organizations relying on Nezha Monitoring should consider this risk in their compliance assessments.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for suspicious GET requests to the endpoint pattern /api/v1/cron/<known-id>/manual on Nezha Monitoring dashboard versions 1.0.0 to 2.0.13.

Since the vulnerability involves triggering stored cron commands via cross-site GET requests authenticated by a JWT cookie, network detection can focus on identifying such GET requests that attempt to manually trigger cron jobs.

• Use web server or proxy logs to search for GET requests matching the pattern: /api/v1/cron/*/manual
• Example command to search logs (assuming Apache logs): grep 'GET /api/v1/cron/' /var/log/apache2/access.log | grep '/manual'
• Use network monitoring tools to detect unusual cross-site GET requests containing JWT cookies targeting the manual cron trigger endpoint.
• Check the version of Nezha Monitoring agents and dashboards to confirm if they are within the vulnerable range (1.0.0 to before 2.0.14).

Useful 0 Not Useful 0