Executive Summary

This vulnerability exists in Nezha Monitoring versions from 2.0.14 up to but not including 2.1.0. The PATCH /server/{id} endpoint accepts and stores IDs for ddns_profiles that do not actually exist for a member-owned server. If another user later creates a DDNS profile using one of those stored nonexistent IDs, the DDNS worker will resolve that stored ID and send updates using the other user's DDNS profile configuration, but in the context of the attacker’s server. This means an attacker can manipulate DDNS profile associations to cause unintended updates.

This issue was fixed in version 2.1.0.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to unauthorized use of another user's DDNS profile configuration in the context of the attacker's server. This can cause incorrect or malicious updates to be dispatched, potentially disrupting monitoring operations or causing data integrity issues.

According to the CVSS score of 6.4 (medium severity), the impact includes limited integrity and availability loss, meaning attackers can alter information or cause partial service disruption without gaining full control.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Nezha Monitoring to version 2.1.0 or later, where the issue has been patched.

Useful 0 Not Useful 0