Buriburizaemon/nezha_domains
1
0
Fork 0
mirror of https://github.com/Buriburizaem0n/nezha_domains.git synced 2026-09-19 17:50:12 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): reserve dashboard hosts from NAT and re-check DDNS profile ownership at worker time

Browse Source 
GHSA-x6fg-52vr-hj4w: NAT is a commonHandler any authenticated member can
create, and newHTTPandGRPCMux matches r.Host against NAT before dispatching
the dashboard/gRPC handlers, so a member could register the dashboard's own
host as a NAT Domain and hijack global routing. Add IsReservedDashboardHost
(InstallHost/ListenHost plus an operator-declared ReservedHosts list for
reverse-proxy deployments), reject reserved hosts on create/update, and drop
pre-planted records when building the startup cache.

GHSA-39g2-8x68-pmx8: bind-time CheckPermission let a member pre-bind a DDNS
profile ID that the victim would only create later. GetDDNSProvidersFromProfiles
now re-validates ownership by server owner UID and skips foreign-owned
profiles (UserID==0 is treated as a migration artifact, not an admin grant).

Co-authored-by: cloudcode <cloudcode@users.noreply.github.com>
This commit is contained in:
naiba
2026-05-31 02:04:35 +00:00
co-authored by cloudcode
parent e8dabf5bc6
commit d4837dfc7a
10 changed files with 390 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cmd/dashboard/controller/nat.go
+8
View File
@@ -64,6 +64,10 @@ func createNAT(c *gin.Context) (uint64, error) {
return 0, singleton.Localizer.ErrorT("permission denied")
}
if singleton.IsReservedDashboardHost(nf.Domain) {
return 0, singleton.Localizer.ErrorT("permission denied")
}
uid := getUid(c)
n.UserID = uid
@@ -117,6 +121,10 @@ func updateNAT(c *gin.Context) (any, error) {
return nil, singleton.Localizer.ErrorT("permission denied")
}
if singleton.IsReservedDashboardHost(nf.Domain) {
return nil, singleton.Localizer.ErrorT("permission denied")
}
var n model.NAT
if err = singleton.DB.First(&n, id).Error; err != nil {
return nil, singleton.Localizer.ErrorT("profile id %d does not exist", id)