Netdata is an open source observability tool. From 2.0.0 until 2.11.0, Netdata registers /api/v3/settings in src/web/api/v3/web_api_v3.c with HTTP_ACL_NOCHECK and HTTP_ACCESS_ANONYMOUS_DATA, causing unauthenticated PUT requests handled by src/web/api/v3/api_v3_settings.c to bypass operator-configured allow dashboard from IP restrictions. A network-reachable caller can persist attacker-controlled JSON in {varlib}/settings/default.json, manipulate its version counter, and use repeated near-20 MiB writes to consume disk space, although the file does not control collection or security policy.
This vulnerability is fixed in 2.11.0.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
None
No data leak
Integrity
Low
Partial data modification
Availability
Low
Partial disruption
CVSS Vector v3.1
Weakness Type (CWE)
References 4
https://github.com/netdata/netdata/commit/0124f50bbcf36c23e798e2b76f021f5032ec9…
security-advisories@github.com
https://github.com/netdata/netdata/pull/22896
security-advisories@github.com
https://github.com/netdata/netdata/releases/tag/v2.11.0
security-advisories@github.com
https://github.com/netdata/netdata/security/advisories/GHSA-8hjg-8hcf-fmwp
security-advisories@github.com