GHSA-hvv7-hfrh-7gxj: Nezha Monitoring: Nezha WebSocket server stream discloses cross-tenant server telemetry to authenticated members
SummaryAny authenticated non-admin member can connect to the server-status WebSocket and receive telemetry for all servers, including servers owned by other users. The normal server list API filters objects by `HasPermission`, but the WebSocket stream treats the presence of any authenticated user as authorization for the full unfiltered server list.DetailsThe server WebSocket route is registered under the optional-auth group in `cmd/dashboard/controller/controller.go:71-73`:`serverStream` treats any `CtxKeyAuthorizedUser` as a member, without checking admin role or per-server ownership, in `cmd/dashboard/controller/ws.go:123-139`:The authorization boolean is then used as a full/guest switch in `getServerStat` in `cmd/dashboard/controller/ws.go:160-184`:For authenticated members, `GetSortedList()` returns all servers and `server.Host` is not filtered. There is no call to `server.HasPermission(c)`.The streamed response model in `model/server_api.go:5-20` includes server ID/name, public note, host details, runtime state, country code, last active time, and global online count. Host and state fields include platform version, agent version, CPU/GPU names, memory/disk/swap totals, architecture, virtualization, boot time, CPU load, memory/disk/swap usage, network transfer/speed, uptime, TCP/UDP/process counts, temperatures, and GPU utilization, as defined in `model/host.go:20-38` and `model/host.go:100-112`.The normal list endpoint has the expected object-level authorization. `GET /api/v1/server` is registered with `listHandler` in `cmd/dashboard/controller/controller.go:113`, and `listHandler` filters each returned object with `HasPermission` in `cmd/dashboard/controller/controller.go:263-291`:The shared permission model in `model/common.go:44-56` allows admins to see all objects but restricts members to objects whose `UserID` matches their user ID:Mitigations checked:Guests receive `GetSortedListForGuest()` and `Host.Filter()` output, but authenticated members bypass both guest restrictions.`HideForGuest` only affects unauthenticated guests, not members.The normal `/api/v1/server` list endpoint uses `listHandler` and is not affected in the same way.No owner/admin filter is applied in the WebSocket path.Candidate score: 12/14Reachability: 2, default WebSocket APIAttacker control: 1, attacker controls authentication state and connectionPrivilege required: 1, authenticated memberSink impact: 2, cross-tenant sensitive telemetry disclosureMitigation weakness: 2, no object-level auth in the WebSocket pathDefault exposure: 2, endpoint is part of default dashboardSafe PoC feasibility: 2, can be verified with local users/servers or staticallyExploitability gate: statically confirmedReachable source: `GET /api/v1/ws/server`Default/common configuration: dashboard API exposed by defaultMissing/bypassed mitigation: member-vs-guest check replaces object-level authorizationImpact-bearing sink: WebSocket response includes unfiltered all-server telemetrySafe proof: static source-to-sink proof; full runtime test blocked locally by unavailable Go 1.26 toolchainAffected version evidence: confirmed at commit `85b0dd2992733037b019442caffc6c049ba937dd` (`v2.0.7-1-g85b0dd2`)Variant review: normal server list endpoint and guest filtering were checkedPoCStatic local PoC steps:Start Nezha with two non-admin users and at least one server assigned to each user.Authenticate as user A.Connect to the WebSocket endpoint with user A's token, for example:Observe that the JSON messages contain entries for all servers from `singleton.ServerShared.GetSortedList()`, including servers whose `UserID` does not match user A.Compare with `GET /api/v1/server` using the same token; that route is filtered through `listHandler`/`HasPermission` and should only return user A's own servers.Cleanup: no persistent state is created by the WebSocket connection.Local dynamic confirmation note: the full project test/runtime could not be executed in this audit environment because the repository requires Go 1.26 and the local toolchain reported `go: download go1.26 for linux/amd64: toolchain not available`.ImpactThis is an authenticated horizontal information disclosure. A low-privileged member can continuously monitor other users' server inventory and live telemetry, including host platform details, agent versions, CPU/GPU details, resource usage, traffic counters, country code, and last-active timestamps. This may expose infrastructure composition, usage patterns, and operational state across tenants.Suggested remediationApply object-level authorization in `getServerStat` for authenticated non-admin users. For each server in the stream, include it only if the current user is admin or `server.UserID` matches the authenticated user. Keep guest filtering and host redaction for unauthenticated users.
CVSS v3.1: 6.5