Summary
Nezha 2.2.3 contains a Host header injection regression in its OAuth2 redirect endpoint when the optional dashboard_host setting is empty. An attacker who can induce an OAuth2 request with a forged Host header may cause the authorization code to be sent to an attacker-controlled callback, potentially enabling account takeover if the identity provider accepts the resulting redirect URI.
Affected context
The issue occurs in Nezha dashboard deployments using the OAuth2 endpoint at /api/v1/oauth2/{provider} when:
- The optional
dashboard_hostconfiguration is empty - The application derives the OAuth2
redirect_urifrom the incoming HTTP Host header - The identity provider accepts the attacker-influenced redirect URI
Deployments with a trusted, explicitly configured dashboard host may not exhibit the same behavior.
Exploit preconditions
- Attack surface: Nezha's OAuth2 login or account-binding endpoint
- Required access: The ability to cause a victim to initiate OAuth2 authentication through a request carrying an attacker-influenced Host header
- Trigger point: Construction of the OAuth2 provider redirect URI
- Configuration condition:
dashboard_hostis empty, causing fallback to the request Host header instead of the configuredinstall_host - Why exploitation is possible: The untrusted Host value can influence the callback destination before authorization-code delivery
Why this happens
The regression trusts a client-controlled HTTP Host header when constructing an OAuth2 redirect_uri under a specific configuration state. Instead of consistently using a trusted, configured origin, the endpoint reflects request metadata into an authentication security boundary. This maps to CWE-601: URL Redirection to Untrusted Site, because OAuth2 authorization results may be redirected to an attacker-controlled destination.
Potential impact
- OAuth2 authorization codes may be delivered to an attacker-controlled origin
- An attacker could complete the OAuth2 login or account-binding flow
- A victim account may be taken over
- Existing account sessions or linked identities could be compromised
- The vulnerability could enable unauthorized access to dashboard functionality and associated data
General mitigation guidance
Mitigation generally focuses on removing request-derived origins from OAuth2 redirect construction and reducing trust in HTTP Host headers.
Common defensive patterns include:
- Prefer a validated, explicitly configured canonical dashboard origin
- Treat empty or missing host configuration as a deployment error rather than falling back to request metadata
- Allow redirect URIs only from a strict, server-side allowlist
- Validate forwarded-host information only when supplied by trusted proxies
- Keep OAuth2 redirect and account-binding endpoints limited to the intended origin
- Apply least privilege to dashboard sessions and OAuth2-linked identities
These controls help prevent authentication responses from being redirected to untrusted locations.
How teams detect issues like this
Organizations can look for this class of issue through:
- Static analysis of OAuth2 redirect construction for direct use of Host, X-Forwarded-Host, or similar request headers
- Code review checks requiring redirect URIs to originate from validated configuration
- Tests covering empty, missing, and malformed canonical-host settings
- Integration tests that verify authorization codes cannot be redirected to unapproved origins
- Monitoring for unusual Host headers and OAuth2 callbacks to unexpected domains
- Policy enforcement requiring explicit redirect-URI allowlists for authentication integrations
Automated code review and security scanning tools may help identify request-derived URL construction.
