Description
Nezha from 2.2.5 before 2.3.15 contains an information disclosure vulnerability that allows authenticated users to retrieve third-party credentials because listDDNS omits WebhookURL and WebhookRequestBody redaction. Admins or PATs with nezha:ddns:read scope can call GET /api/v1/ddns to read cleartext tokens embedded in every user's DDNS webhook profiles.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| nezhahq | nezha | 2.2.5 – < 2.3.15 | 2.3.15 |
References
- GitHub Security Advisory (GHSA-hpfr-cmgc-f455) vendor-advisory
- Patch Commit patch
- Patch Commit patch
- VulnCheck Advisory: Nezha 2.2.5 before 2.3.15 Information Disclosure via DDNS List Endpoint third-party-advisory