Horizon Alert
Summary of the vulnerability and why it matters
This advisory concerns a critical vulnerability in Nezha Monitoring, a tool used for server and website oversight. The flaw allows an authenticated user to access another user's session, read and write files, and execute commands on target servers. The main concern is confirming relevance and exposure, as this could impact systems managed by Nezha Monitoring.
- Unauthorized access to other users' sessions.
- Affects systems allowing remote server management.
- Confirm if your monitoring tools are impacted.
Attack Path
How an attacker could exploit the issue
An authenticated user with a "RoleMember" privilege can hijack another user's session by obtaining a stream identifier. This allows them to access another user's terminal or file management interface, potentially leading to unauthorized file modification, reading, and command execution on the targeted server.
- Authenticated access required.
- Hijack stream UUID to access sessions.
- Read/write files, execute commands.
Live Threat
Current exploitation, exposure, and threat context
An authenticated user with the 'RoleMember' role could hijack another user's session to access their terminal or file manager. This could allow them to read and write files on the target server and execute shell commands.
- Server files and terminal sessions.
- Unprotected stream identifiers allow session attachment.
- Unauthorized file access and command execution.
Operational Fix
Recommended remediation, mitigation, and detection steps
This vulnerability affects Nezha Monitoring, a self-hosted O&M tool. The application owners or platform team responsible for Nezha Monitoring instances should first identify all deployments, determine their reachability and criticality, and then plan remediation. Coordination with the vendor for patches or mitigation strategies is essential.
- Application or platform team ownership.
- Verify deployment reachability and criticality.
- Plan remediation or vendor coordination.
