Nezha Information Disclosure via Unprotected Profile Endpoint

Executive Summary

Nezha before version 2.2.7 has an information disclosure vulnerability in the GET /api/v1/profile endpoint. This endpoint returns the bcrypt-hashed password field of authenticated users, allowing attackers to extract password hashes and perform offline cracking attempts without rate limiting or audit trail constraints.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your Nezha instance is running a version before 2.2.7. Inspect network traffic for requests to the GET /api/v1/profile endpoint. Verify if the response includes a bcrypt-hashed password field for authenticated users.

Useful 0 Not Useful 0

Impact Analysis

Attackers could obtain bcrypt-hashed passwords from the vulnerable endpoint and attempt to crack them offline. This could lead to unauthorized account access if weak or common passwords are used. The lack of rate limiting or audit trails may make detection of such attacks difficult.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate data protection requirements under GDPR and HIPAA by exposing sensitive user credentials. GDPR requires protection of personal data, while HIPAA mandates safeguards for protected health information. The disclosure of password hashes may indicate insufficient security controls.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Nezha to version 2.2.7 or later. If upgrading is not possible, restrict access to the /api/v1/profile endpoint and monitor for unauthorized access attempts. Rotate all bcrypt-hashed passwords if they may have been exposed.

Useful 0 Not Useful 0