Description
Nezha from 2.1.0 before 2.3.15 contains a host header injection vulnerability in mintTransferTool that builds fs.download_url and fs.upload_url transfer URLs from the unvalidated Host header. Attackers who control the Host header seen on a victim's MCP request can redirect file uploads or capture one-time download tokens and replay them to exfiltrate files.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| nezhahq | nezha | 2.1.0 – < 2.3.15 | 2.3.15 |
References
- GitHub Security Advisory (GHSA-rj3w-jrj7-x7c3) vendor-advisory
- Patch Commit patch
- Patch Commit patch
- VulnCheck Advisory: Nezha 2.1.0 before 2.3.15 Host Header Injection via MCP Transfer Tools third-party-advisory