GHSA-rf68-8gjr-36q7: Nezha OAuth2 Redirect_uri Host Header Injection Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-rf68-8gjr-36q7",
  "modified" : "2026-09-15T19:50:08Z",
  "published" : "2026-09-15T19:50:08Z",
  "aliases" : [ ],
  "summary" : "Nezha: OAuth2 redirect_uri Host header injection regression when dashboard_host is empty",
  "details" : "## Summary\n\nNezha v2.2.3 regresses the GHSA-9rc6-8cjv-rcvx host header injection fix for deployments where the new `dashboard_host` setting is empty. In that configuration, `/api/v1/oauth2/{provider}` again reflects the request `Host` header into the OAuth2 `redirect_uri` sent to the identity provider, even if `install_host` is configured.\n\n## Impact\n\nAn attacker who can get a victim to start OAuth2 login through a request that reaches Nezha with a forged `Host` header can make Nezha send an attacker-controlled callback URL as the OAuth2 `redirect_uri`. If the configured OAuth2 provider accepts that redirect URI, the victim's authorization code is sent to the attacker origin. The attacker can then complete the OAuth2 binding or login flow described in GHSA-9rc6.\n\nThis is configuration-dependent, but it affects a realistic upgrade/default state because `dashboard_host` is a new optional field. The original v2.2.0 fix fell back to `install_host`; current v2.2.3 only falls back when `dashboard_host` is non-empty.\n\n## Reproduction\n\nOn current v2.2.3 / master commit `3d74cd9431a48fa89c6489689eac82a872799ea0`, configure OAuth2 and set an existing dashboard host only through `install_host`, leaving `dashboard_host` empty. Then send the OAuth2 redirect request with a forged Host header:\n\n```http\nGET /api/v1/oauth2/github?type=1 HTTP/1.1\nHost: evil.attacker.test\nX-Forwarded-Proto: https\n```\n\nThe generated OAuth2 authorization URL contains:\n\n```text\nredirect_uri=https%3A%2F%2Fevil.attacker.test%2Fapi%2Fv1%2Foauth2%2Fcallback\n```\n\nA minimal route-level unit test demonstrating the issue is:\n\n```go\nfunc TestOAuth2Redirect_RegressionWhenDashboardHostEmptyReflectsForgedHost(t *testing.T) {\n    defer setupOAuth2Test(t)()\n    singleton.Conf.InstallHost = \"legit-dashboard.example.com\"\n    singleton.Conf.DashboardHost = \"\"\n    singleton.Conf.Oauth2[\"github\"] = &model.Oauth2Config{\n        ClientID: \"client-id\",\n        ClientSecret: \"client-secret\",\n        Endpoint: model.Oauth2Endpoint{AuthURL: \"https://idp.example.test/authorize\", TokenURL: \"https://idp.example.test/token\"},\n        Scopes: []string{\"openid\"},\n    }\n\n    c, _ := newOAuth2Ctx(t)\n    c.Params = gin.Params{{Key: \"provider\", Value: \"github\"}}\n    c.Request.Host = \"evil.attacker.test\"\n    c.Request.URL.RawQuery = \"type=1\"\n    c.Request.Header.Set(\"X-Forwarded-Proto\", \"https\")\n\n    resp, err := oauth2redirect(c)\n    require.NoError(t, err)\n\n    parsed, err := url.Parse(resp.Redirect)\n    require.NoError(t, err)\n    require.Equal(t, \"https://evil.attacker.test/api/v1/oauth2/callback\", parsed.Query().Get(\"redirect_uri\"))\n}\n```\n\nThe corresponding control with `DashboardHost = \"panel.example.com\"` pins the same forged request to `https://panel.example.com/api/v1/oauth2/callback`, so the issue is specifically the empty `dashboard_host` fallback.\n\n## Root cause\n\nCurrent `cmd/dashboard/controller/oauth2.go` chooses the request Host unless `DashboardHost` is non-empty:\n\n```go\nhost := c.Request.Host\nif !singleton.IsReservedDashboardHost(host) && singleton.Conf != nil && singleton.Conf.DashboardHost != \"\" {\n    host = singleton.Conf.DashboardHost\n}\nreturn scheme + host + \"/api/v1/oauth2/callback\"\n```\n\nThe v2.2.0 fix used `InstallHost` as the fallback for untrusted request hosts. After `DashboardHost` was introduced, empty `dashboard_host` now disables host pinning and reintroduces the original Host header injection behavior for those deployments.\n\n## Remediation\n\nBuild the OAuth2 callback URL from a deterministic configured origin. For example:\n\n1. Use `DashboardHost` when it is set.\n2. Otherwise fall back to `InstallHost` if it is set, preserving the v2.2.0 invariant for existing deployments.\n3. If neither value is set, reject OAuth2 redirect initiation with a configuration error instead of reflecting request Host.\n\nPlease also add a regression test that `InstallHost` plus empty `DashboardHost` does not reflect a forged Host into `redirect_uri`.",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:P"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/nezhahq/nezha"
    },
    "versions" : [ "2.2.3" ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/nezhahq/nezha/security/advisories/GHSA-rf68-8gjr-36q7"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/nezhahq/nezha/commit/38824dbc11a63964c5b9296ae4c68e62b34fa04b"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/nezhahq/nezha"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-601" ],
    "severity" : "LOW",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-09-15T19:50:08Z",
    "nvd_published_at" : null
  }
}