CyberRota Analysis
AI-GeneratedNezha Monitoring versions prior to 2.2.5 expose sensitive plaintext third-party API credentials, including Cloudflare tokens and webhook URLs, through the GET /api/v1/ddns and GET /api/v1/notification endpoints without proper redaction. This vulnerability allows any authenticated admin or user with specific read permissions to access these credentials, potentially leading to unauthorized access to integrated services. Organizations using Nezha Monitoring should prioritize upgrading to version 2.2.5 to mitigate the risk of credential leakage.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. Prior to 2.2.5, the GET /api/v1/ddns and GET /api/v1/notification endpoints return full resource objects including plaintext third-party API credentials, including Cloudflare API tokens, TencentCloud SecretKeys, Slack, Discord, and Telegram webhook URLs with embedded bot tokens, and Authorization header values, without any field-level redaction. Any authenticated admin or PAT with nezha:ddns:read or nezha:notification:read scope can receive stored credentials through the listDDNS and listNotification handlers in a single API response. This issue is fixed in version 2.2.5.