GHSA-rf68-8gjr-36q7

Summary

Nezha v2.2.3 regresses the GHSA-9rc6-8cjv-rcvx host header injection fix for deployments where the new dashboard_host setting is empty. In that configuration, /api/v1/oauth2/{provider} again reflects the request Host header into the OAuth2 redirect_uri sent to the identity provider, even if install_host is configured.

Impact

An attacker who can get a victim to start OAuth2 login through a request that reaches Nezha with a forged Host header can make Nezha send an attacker-controlled callback URL as the OAuth2 redirect_uri. If the configured OAuth2 provider accepts that redirect URI, the victim's authorization code is sent to the attacker origin. The attacker can then complete the OAuth2 binding or login flow described in GHSA-9rc6.

This is configuration-dependent, but it affects a realistic upgrade/default state because dashboard_host is a new optional field. The original v2.2.0 fix fell back to install_host; current v2.2.3 only falls back when dashboard_host is non-empty.

Reproduction

On current v2.2.3 / master commit 3d74cd9431a48fa89c6489689eac82a872799ea0, configure OAuth2 and set an existing dashboard host only through install_host, leaving dashboard_host empty. Then send the OAuth2 redirect request with a forged Host header:

GET /api/v1/oauth2/github?type=1 HTTP/1.1
Host: evil.attacker.test
X-Forwarded-Proto: https

The generated OAuth2 authorization URL contains:

redirect_uri=https%3A%2F%2Fevil.attacker.test%2Fapi%2Fv1%2Foauth2%2Fcallback

A minimal route-level unit test demonstrating the issue is:

func TestOAuth2Redirect_RegressionWhenDashboardHostEmptyReflectsForgedHost(t *testing.T) {
    defer setupOAuth2Test(t)()
    singleton.Conf.InstallHost = "legit-dashboard.example.com"
    singleton.Conf.DashboardHost = ""
    singleton.Conf.Oauth2["github"] = &model.Oauth2Config{
        ClientID: "client-id",
        ClientSecret: "client-secret",
        Endpoint:...