Executive brief
Nezha, a server monitoring and management dashboard, contains a flaw that allows an authenticated user to hijack terminal and file manager sessions belonging to other users. By obtaining a session identifier—which may be leaked in server logs or browser history—an attacker can gain full command-line access or file system control over managed servers. This could lead to complete unauthorized control of the infrastructure and exposure of sensitive data.
Technical details
The vulnerability exists in the WebSocket endpoints `GET /ws/terminal/:id` and `GET /ws/file/:id` within `cmd/dashboard/controller/terminal.go` and `cmd/dashboard/controller/fm.go`. The application validates the existence of a stream UUID in the global `ioStreams` map but fails to verify if the requesting user is the one who initiated the stream. Because these UUIDs are passed as URL path components, they are susceptible to leakage via reverse-proxy logs, Referer headers, and browser history. An authenticated attacker (even with low privileges like `RoleMember`) can use a leaked UUID to attach to an active session, achieving interactive shell access (RCE) or arbitrary file read/write. The issue was fixed in version 2.0.10 by binding streams to the creator's user ID.
Affected products
- nezhahq nezha >= 1.14.13, <= 1.14.14
- nezhahq nezha >= 2.0.0, <= 2.0.9
Timeline
- 2026-05-18: patched: Fixed in commit 6661d6a
- 2026-05-19: advisory: Shipped in version 2.0.10
- 2026-06-26: disclosed: GHSA published
References
- https://api.github.com/users/Uhudsavasindankacanokcu2
- https://github.com/Uhudsavasindankacanokcu2
- https://api.github.com/users/Uhudsavasindankacanokcu2/gists%7B/gist_id%7D
- https://api.github.com/users/Uhudsavasindankacanokcu2/repos
- https://avatars.githubusercontent.com/u/71898880?v=4
- https://api.github.com/users/Uhudsavasindankacanokcu2/events%7B/privacy%7D