Nezha Resource Exhaustion via Unbounded WebSocket Connections

Executive Summary

Nezha versions 2.0.13 to 2.3.14 contain a resource exhaustion vulnerability in the /api/v1/ws/transfer WebSocket endpoint. Authenticated users can create unlimited concurrent connections by exploiting the ServerTransferClass.Subscribe method. This exhausts file descriptors, memory, and goroutines, blocking agent gRPC reconnections.

Useful 0 Not Useful 0

Detection Guidance

Monitor for unusually high numbers of WebSocket connections to /api/v1/ws/transfer. Use netstat or ss to check active connections: netstat -an | grep :80 | grep ESTABLISHED or ss -s. Inspect goroutine usage with pprof if Nezha is running. Check for blocked gRPC reconnections in agent logs.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to exhaust system resources, causing denial of service. This prevents new connections, including critical agent gRPC reconnections, leading to service unavailability. Each connection consumes about 72 KB of memory and a file descriptor.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling denial-of-service attacks that disrupt system availability. GDPR requires maintaining service availability for data processing, while HIPAA mandates reliable access to protected health information systems. Resource exhaustion could lead to prolonged downtime, violating availability requirements in both standards.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Nezha to version 2.3.15 or later immediately. Apply per-user connection limits or use a reverse proxy like Nginx to enforce WebSocket connection caps. Block or rate-limit excessive connections to /api/v1/ws/transfer.

Useful 0 Not Useful 0