Nezha Monitoring is vulnerable to a server-side request forgery (SSRF) issue in versions >=0.20.0 and <2.0.10. Authenticated users can create or update DDNS profiles with arbitrary webhook URLs, HTTP methods, request bodies, and headers. When the DDNS triggers, the dashboard sends the configured HTTP request using utils.HttpClient without applying SSRF protections that are present in notification webhooks. This enables low-privileged authenticated users controlling a DDNS profile to induce the dashboard host to make HTTP requests to internal or loopback network services. The vulnerability is a blind SSRF, as the response body is not returned to the attacker. The vulnerability has been patched in version 2.0.10.

An attacker with authenticated access to the Nezha dashboard can exploit this SSRF vulnerability to make the dashboard server send arbitrary HTTP requests to internal or loopback network services. This could allow the attacker to interact with internal services that are not otherwise accessible externally, potentially causing internal state changes. The confidentiality and integrity impacts are limited to what can be achieved via these internal requests. The vulnerability does not allow direct response data to be exfiltrated, as the response body is not returned to the attacker. Availability impact is not indicated.

This vulnerability is patched in Nezha Monitoring version 2.0.10. Users should upgrade to version 2.0.10 or later to remediate this issue. No official temporary fixes or workarounds are indicated in the advisory. Until upgrading, restrict dashboard user privileges to trusted users only to reduce risk.