Description
Nezha 2.0.0 before 2.4.0 contains a NULL pointer dereference vulnerability in ServiceSentinel.loadTodayStats that allows authenticated users to crash the dashboard by deleting a service. Attackers can delete their own service via POST /api/v1/batch-delete/service, leaving orphaned service_histories rows that crash the non-TSDB dashboard on its next startup until removed manually.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| nezhahq | nezha | 2.0.0 – < 2.4.0 | 2.4.0 |
References
- Patch Commit patch
- nezha v2.4.0 Release Notes release-notes
- loadTodayStats unchecked map dereference (2.3.18) technical-description
- Service deletion leaves service_histories rows (2.3.18) technical-description
- https://github.com/nezhahq/nezha product
- VulnCheck Advisory: Nezha 2.0.0 before 2.4.0 Startup NULL Pointer Dereference via Orphaned Service History third-party-advisory