Listen to this Post
This vulnerability resides in the NeZha Dashboard’s handling of administrative API endpoints. The core issue is that the `GET /api/v1/ddns` and `GET /api/v1/notification` endpoints return full, unredacted resource objects to any authenticated administrator.
When an admin user calls these endpoints, the application’s backend, specifically the `listDDNS` and `listNotification` handlers, retrieves the complete list of stored profiles and copies them directly into the response using copier.Copy. This process fails to strip or mask sensitive fields.
The `DDNSProfile` struct serializes fields like `AccessSecret` (which contains Cloudflare API tokens or TencentCloud SecretKeys) in cleartext. Similarly, the `Notification` struct exposes URL, RequestHeader, and RequestBody, which often contain embedded bot tokens for services like Slack, Discord, and Telegram, along with API keys in `Authorization` headers.
Both routes are protected by authentication middleware (authMw) and require specific read scopes (nezha:ddns:read or nezha:notification:read). However, the subsequent `HasPermission` filter grants administrators access to ALL profiles in the system, regardless of ownership. No separate response structs or field-masking logic exist to prevent this exposure.
This pattern is particularly concerning because the codebase already demonstrates an awareness of this type of issue. A similar sensitive data exposure was previously addressed for the `client_secret` via the `serverConfigSensitiveScope()` function, which restricted access to that field. However, no equivalent protection was implemented for the DDNS or Notification list endpoints.
An attacker who compromises an admin session or obtains a Personal Access Token (PAT) with the required read scope can exfiltrate all third-party credentials stored in the dashboard with a single API call. This crosses a critical security boundary, as a read-only listing endpoint should never return write-capable credentials.
DailyCVE Form
Platform: NeZha Dashboard
Version: <= v2.2.3 (commit 3d74cd94)
Vulnerability: Credential Exposure
Severity: High
Date: 2026-06-26
Prediction: 2026-07-10
What Undercode Say: Analytics
Bash Commands to Exploit
Expose DDNS credentials (e.g., Cloudflare API tokens) curl -s -H "Authorization: Bearer <admin_jwt_or_pat>" \ https://dashboard.example.com/api/v1/ddns | jq '.data[].access_secret' Expose Notification webhook secrets (e.g., Slack/Discord/Telegram tokens) curl -s -H "Authorization: Bearer <admin_jwt_or_pat>" \ https://dashboard.example.com/api/v1/notification | jq '.data[].url' Expose full Authorization headers from notification configs curl -s -H "Authorization: Bearer <admin_jwt_or_pat>" \ https://dashboard.example.com/api/v1/notification | jq '.data[].request_header'
Vulnerable Code Snippets
The `listDDNS` handler in `cmd/dashboard/controller/ddns.go`:
func listDDNS(c gin.Context) ([]model.DDNSProfile, error) {
var ddnsProfiles []model.DDNSProfile
list := singleton.DDNSShared.GetSortedList()
if err := copier.Copy(&ddnsProfiles, &list); err != nil {
return nil, err
}
return ddnsProfiles, nil
}
The `DDNSProfile` struct in `model/ddns.go` serializes `AccessSecret` with json:"access_secret,omitempty".
The `listNotification` handler in `cmd/dashboard/controller/notification.go`:
func listNotification(c gin.Context) ([]model.Notification, error) {
slist := singleton.NotificationShared.GetSortedList()
var notifications []model.Notification
if err := copier.Copy(¬ifications, &slist); err != nil {
return nil, err
}
return notifications, nil
}
The `Notification` struct in `model/notification.go` serializes URL, RequestHeader, and `RequestBody` without redaction.
Route Registration
auth.GET("/notification", restScopeMiddleware(model.ScopeNotificationRead), listHandler(listNotification))
auth.GET("/ddns", restScopeMiddleware(model.ScopeDDNSRead), listHandler(listDDNS))
Exploit
- Prerequisite: The attacker must have compromised an administrator’s session (JWT) or obtained a PAT with the `nezha:ddns:read` or `nezha:notification:read` scope.
- Action: The attacker sends a `GET` request to either `/api/v1/ddns` or `/api/v1/notification` using the stolen credentials.
- Result: The server responds with a JSON payload containing the full, unredacted details of all DDNS profiles or all notification configurations in the system.
- Data Exfiltration: The attacker extracts sensitive credentials from the response, such as:
`access_secret`: Cloudflare API tokens or TencentCloud SecretKeys.
url: Webhook URLs containing embedded tokens for Slack, Discord, or Telegram.
request_header: `Authorization` headers containing API keys or other secrets.
Protection
Immediate Action: Upgrade to the latest patched version of the NeZha Dashboard as soon as it is released.
Mitigation: As a temporary workaround, restrict network access to the dashboard’s administrative API endpoints, allowing connections only from trusted IP addresses.
Long-term Fix: The development team should introduce separate response structs (e.g., DDNSProfileResponse, NotificationResponse) that explicitly omit sensitive fields for list and read endpoints. Alternatively, they can use `json:”-“` tags on sensitive fields and provide them only through a dedicated, more strictly authorized credential-retrieval endpoint.
Impact
Confidentiality Breach: All third-party API credentials stored in the dashboard are exposed.
Account Takeover: An attacker can use the exposed Cloudflare or TencentCloud tokens to modify DNS records, potentially hijacking domains or subdomains.
Service Disruption & Spam: Exposed Slack, Discord, or Telegram webhook URLs can be used to send malicious or spam messages as the legitimate bot.
Lateral Movement: Compromised credentials could provide access to other internal or external systems and APIs.
Privilege Escalation: While the attack requires high privileges, the impact is amplified because a single API call exposes ALL stored credentials, with no field-level access control separating metadata from secrets.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
