Horizon Alert
Summary of the vulnerability and why it matters
A critical vulnerability exists in Nezha Monitoring, a tool used for server and website management. Exploitation could allow a user with limited access to execute arbitrary commands across all servers managed by the system, potentially impacting other tenants' infrastructure. This issue has been addressed in version 2.0.8.
- Unauthorized command execution across all managed servers.
- Impacts other tenants and could disrupt operations.
- Confirm relevance; address if deployed.
Attack Path
How an attacker could exploit the issue
An attacker with RoleMember access can create a scheduled cron task that, when executed, pushes an arbitrary command to all servers managed by Nezha Monitoring, including those belonging to other tenants. This command is executed on each agent, and its output is sent back to an attacker-controlled webhook.
- Requires RoleMember user access.
- Vulnerable cron task creation.
- Cross-tenant command execution.
Live Threat
Current exploitation, exposure, and threat context
A RoleMember user could abuse a scheduled cron task to execute arbitrary commands across all servers managed by Nezha Monitoring, including those belonging to other tenants. This could occur when the scheduler ticks, pushing the command to every server in the global ServerShared map. The command's output is then sent to an attacker-controlled webhook.
- Arbitrary command execution on managed servers.
- Malicious command pushed to all servers.
- Widespread system compromise possible.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
This vulnerability in Nezha Monitoring affects self-hosted instances, placing responsibility on the teams managing the application infrastructure and potentially those responsible for server administration. The first practical step is to inventory all Nezha Monitoring deployments, confirm their network exposure, identify the accountable owner for each instance, and then prioritize remediation based on the business criticality and reachability of the affected servers.
- Identify Nezha Monitoring deployment owners.
- Verify network exposure and critical assets.
- Plan remediation or vendor engagement.
