Description
Nezha 2.0.0 before 2.4.0 contains a NULL pointer dereference vulnerability in ServiceSentinel.loadTodayStats that allows authenticated users to crash the dashboard by deleting a service. Attackers can delete their own service via POST /api/v1/batch-delete/service, leaving orphaned service_histories rows that crash the non-TSDB dashboard on its next startup until removed manually.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
nezhahq nezha
Default version status: unaffected
2.0.0 to < 2.4.0affected
pkg:golang/github.com/nezhahq/nezhaReferences
- https://github.com/nezhahq/nezha/commit/efd3e07b901d6acf7ef2ab3b26458cc07e7605dc ↗
- https://github.com/nezhahq/nezha/releases/tag/v2.4.0 ↗
- https://github.com/nezhahq/nezha/blob/9881c47f0cc92256ba203919da5a25fab79a6bad/service/singleton/servicesentinel.go#L434 ↗
- https://github.com/nezhahq/nezha/blob/9881c47f0cc92256ba203919da5a25fab79a6bad/cmd/dashboard/controller/service.go#L639 ↗
- https://github.com/nezhahq/nezha ↗
- https://www.vulncheck.com/advisories/nezha-2.0.0-before-2.4.0-startup-null-pointer-dereference-via-orphaned-service-history ↗