Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability is a Cross-Site Request Forgery (CSRF) weakness in the Nezha dashboard. The endpoint /api/v1/cron/:id/manual was configured to use the HTTP GET method for a state-changing operation (manually triggering a cron job). Authentication is handled via a cookie (nz-jwt) with the SameSite=Lax attribute. This attribute allows the cookie to be sent with top-level cross-site GET requests.
An attacker could craft a malicious link or embed an image on an external website pointing to the vulnerable endpoint. If a logged-in Nezha user visits the attacker's site, their browser would automatically send the GET request along with the authentication cookie, triggering the cron job without the user's knowledge or consent.
The analysis of the patch confirms this vulnerability. The commit 10327f345b14e1e07feea3b6b7835f698267bedd changes the route from GET to POST. This is the standard mitigation for CSRF on state-changing endpoints, as SameSite=Lax cookies are not sent with cross-site POST requests from a simple HTML form or link, effectively blocking this attack vector.
The primary vulnerable function is controller.manualTriggerCron, which is the entry point for the request. The functions singleton.ManualTrigger and singleton.CronTrigger are also identified as they are part of the execution chain that leads to the command being dispatched and would appear in a runtime profile during exploitation.
controller.manualTriggerCroncmd/dashboard/controller/cron.go
singleton.ManualTriggerservice/singleton/crontask.go
singleton.CronTriggerservice/singleton/crontask.go
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/nezhahq/nezha | go | >= 1.0.0, < 2.0.14 | 2.0.14 |