Netdata Unauthenticated PUT Bypass IP Whitelist via HTTP_ACL_NOCHECK

Vulnerability Summary Vulnerability Overview Title: Unauthenticated remote PUT request to bypasses IP whitelist control (via ) Severity: Medium Description: The API endpoint is registered with and , allowing any remote unauthenticated caller to issue PUT requests that persistently overwrite the agent's settings store, regardless of any IP whitelists configured by operators. Due to the default binding configuration (port 19999 on all interfaces), any network-reachable host can exploit this vulnerability. The impact is the persistent compromise of settings store integrity and availability, with attackers able to submit up to approximately 20 MB of data. Root Cause: causes the web ACL layer to completely skip IP-based whitelist evaluation. Operators who have configured an IP whitelist may mistakenly believe they have locked down external access, but routes marked with are enforced unconditionally. Affected Scope Affected Versions: >= v2.0.0, = v2.10.4 >= v2.10.0-782-nightly Affected Endpoints (all endpoints bypass IP whitelist enforcement): Specific Impacts: Persistent override of Dashboard settings with attacker-controlled JSON, affecting all subsequent clients that load these settings. Near 20 MB of disk writes per request, without rate limiting, potentially leading to disk exhaustion on storage-constrained agents. Manipulation of version counters, which can potentially disrupt legitimate settings synchronization. The broader pattern represents a systemic defense-in-depth flaw: operators who configure IP whitelists are not warned, and multiple endpoints remain unconditionally accessible to remote unauthenticated callers. Remediation 1. Remove : Remove it from the settings endpoint and apply appropriate ACL enforcement, consistent with the policy for other state-modifying endpoints, allowing operators to restrict access to GET only. 2. Restrict PUT Operations: Limit PUT requests on to authenticated callers, requiring at least the same access level as dashboard write operations. 3. Audit All Registrations: Explicitly document which endpoints bypass IP whitelist enforcement by design, enabling operators to make informed decisions regarding network exposure. Proof of Concept (POC) Expected Result: All requests succeed with HTTP 200. The settings are persisted to , and the writes are reflected in subsequent GET requests. No credentials, session, or IP whitelist exemption are required.

Goal Reached Thanks to every supporter — we hit 100%!

Netdata Unauthenticated PUT Bypass IP Whitelist via HTTP_ACL_NOCHECK

More from this source