HAERIN-L/POC_CVE-2026-46716

# CVE-2026-46716 — Nezha Monitoring 通过 Cron API 授权绕过实现跨租户 RCE 一个用于复现和检测 **CVE-2026-46716** 的实验室环境，这是 Nezha Monitoring 中的一个严重漏洞，其 `POST /api/v1/cron` 端点缺乏管理员权限检查，允许 RoleMember 用户实现跨租户远程代码执行。 ## 漏洞概述 | 字段 | 详情 | |-------|---------| | CVE ID | CVE-2026-46716 | | GHSA | [GHSA-99gv-2m7h-3hh9](https://github.com/nezhahq/nezha/security/advisories/GHSA-99gv-2m7h-3hh9) | | CVSS | 9.9 (严重) — `AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H` | | 受影响版本 | nezhahq/nezha >= 1.4.0, < 1.14.15-0.20260517022419-d7526351cf97 | | 已修复 | v1.14.15-0.20260517022419-d7526351cf97 (commit d7526351cf97, 2026-05-17) | | CWE | CWE-862 (缺少授权), CWE-269 (权限管理不当), CWE-78 (操作系统命令注入) | ### 根本原因 ``` Vulnerable path: POST /api/v1/cron → commonHandler (JWT auth only, no role check) → CheckPermission(servers=[]) → iterates empty list → returns true unconditionally → CronTrigger dispatches command to ALL servers via ServerShared map ❌ No admin check, no ownership validation → cross-tenant RCE Patched path: POST /api/v1/cron → commonHandler (same — HTTP 200 still returned for members) → CheckPermission(servers=[]) → true (unchanged) → CronTrigger: cronCanSendToServer(cr, s) checks cr.UserID == s.UserID ✅ Commands only dispatched to servers owned by the cron creator ``` ### 攻击前提条件 | # | 条件 | 详情 | |---|-----------|---------| | 1 | 受影响的 Nezha 版本 | < 1.14.15-0.20260517022419 | | 2 | 已认证的账户 | `RoleMember` (最低权限级别) | | 3 | 空的服务器列表 | `"servers":[], "cover":1` 绕过 CheckPermission | ## 实验室架构 ``` Host Machine ├── localhost:8008 ──→ Docker: nezha-vuln (v1.14.14 ⚠ VULNERABLE) └── localhost:8009 ──→ Docker: nezha-patched (commit d7526351cf97 ✓ PATCHED, built from source) ``` ## 前置条件 | 工具 | 安装 | |------|---------| | [Docker Desktop](https://www.docker.com/) | docker.com | | [nuclei](https://github.com/projectdiscovery/nuclei) | `brew install nuclei` | | curl, python3 | macOS 上预装 | ## 如何运行 ### 步骤 1 — 搭建实验室环境 ``` bash scripts/01-setup.sh ``` 完成后： ``` ══════════════════════════════════════════════════════ Lab ready! ══════════════════════════════════════════════════════ Vulnerable (v1.14.14) : http://localhost:8008 Patched (latest) : http://localhost:8009 Admin : admin / admin Member : member / Memberpass123! ══════════════════════════════════════════════════════ ``` ### 步骤 2 — 触发 CVE ``` bash scripts/03-trigger-cve.sh ``` **预期输出 — 易受攻击的版本 (v1.14.14):** ``` HTTP 200 — Cron created (id: 1) ⚠ RESULT: ADMIN CHECK BYPASSED — VULNERABLE ``` **预期输出 — 已修复版本：** ``` HTTP 403 — Access denied ✓ RESULT: Admin check enforced — PATCHED ``` ### 步骤 3 — Nuclei 检测 ``` # Vulnerable cluster → 应该产生一个 [critical] finding nuclei -duc -t nuclei/CVE-2026-46716.yaml \ -u http://localhost:8008 \ -var username=admin \ -var password=admin # Patched cluster → 不应该产生任何 findings nuclei -duc -t nuclei/CVE-2026-46716.yaml \ -u http://localhost:8009 \ -var username=admin \ -var password=admin ``` ### 步骤 4 — 清理与拆除 ``` bash scripts/99-teardown.sh ``` ## 目录结构 ``` nezha-cve-2026-46716-lab/ ├── README.md ├── LAB_SETUP_GUIDE.md # Lab setup guide (English) ├── VULNERABILITY_ANALYSIS.md # Code-level vulnerability analysis (English) ├── NUCLEI_TEMPLATE_GUIDE.md # Nuclei template design and test results (English) ├── docker-compose.yaml │ ├── REPORT/ # Korean reports │ ├── LAB_REPORT_KR.md │ ├── Nuclei_Template_Report_KR.md │ └── Vulnerability_Analysis_KR.md │ ├── nuclei/ │ └── CVE-2026-46716.yaml # Nuclei detection template │ └── scripts/ ├── 01-setup.sh # Start containers, create member account ├── 03-trigger-cve.sh # PoC: trigger auth bypass, verify result └── 99-teardown.sh # Stop and remove all lab resources ``` ## Nuclei 模板检测逻辑 ``` Step 1 POST /api/v1/login (admin credentials) → authenticate and extract JWT token Step 2 GET /api/v1/setting → version field matched against vulnerable range (1.4.x – 1.14.14) → match → FINDING: vulnerable version detected → no match (>= 1.14.15 or "debug") → no finding ``` 只要带有 `servers:[], cover:1`，易受攻击和已修复版本对于 `POST /api/v1/cron` 都会返回 HTTP 200 —— 因此无法进行行为检测。该补丁仅在执行时于 CronTrigger 内部添加了所有权验证，而不是在 API 层面。需要管理员凭据，因为 `GET /api/v1/setting` 仅对 RoleAdmin 用户返回 `version` 字段。 ## 参考 - [GHSA-99gv-2m7h-3hh9](https://github.com/nezhahq/nezha/security/advisories/GHSA-99gv-2m7h-3hh9) - [NVD — CVE-2026-46716](https://nvd.nist.gov/vuln/detail/CVE-2026-46716)

标签：Docker, 安全漏洞, 安全防御评估, 应用安全, 漏洞复现, 编程工具, 请求拦截, 越权漏洞, 远程代码执行, 逆向工具, 靶场环境