Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

nezhahq/nezha

              master @ fd31e5f
            

Fixes

CVEs

CRITICAL

Peak severity

48.7%

Coverage

Highlights

Auth Bypass: 23 prior fixes. Scrutinize any change in this area.

cmd/dashboard/controller/oauth2.go: most-fixed (6 issues). Treat as high-risk during review.

28 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: The application historically constructed OAuth2 callback URLs using the untrusted HTTP Host header directly from the client request, allowing attackers to hijack authentication sessions via Host header forgery. Fixes decoupled redirection logic and validated Host headers against an explicit, trusted host allowlist.

SSRF: Webhooks and notifications fetch and send HTTP requests to user-controlled URLs without validating target IP addresses. This allowed attackers with dashboard access to route requests into internal network zones or query cloud metadata. Patches introduced strict CIDR blocklists and local IP checks on resolved socket addresses.

Auth Bypass: Lack of ownership validation during alert rule configuration allowed authenticated tenants to access and trigger scheduled cron tasks belonging to other users. This critical isolation failure was resolved by introducing explicit permission checks on trigger tasks.