An issue was discovered in Netdata 1.10.0. HTTP Header Injection exists via the api/v1/data filename parameter because of web_client_api_request_v1_data in web/api/web_api_v1.c.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7250-1 advisory.

    It was discovered that Netdata incorrectly handled parsing JSON input, which could lead to a JSON     injection. An attacker could possibly use this issue to execute arbitrary code. This issue only affected

    Ubuntu 18.04 LTS. (CVE-2018-18836)

    It was discovered that Netdata incorrectly handled parsing HTTP headers, which could lead to a HTTP header     injection. An attacker could possibly use this issue to cause a denial of service or leak sensitive     information. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-18837)

    It was discovered that Netdata incorrectly handled parsing URLs, which could lead to a log injection. An     attacker could possibly use this issue to consume system resources, resulting in a denial of service. This     issue only affected Ubuntu 18.04 LTS. (CVE-2018-18838)

    It was discovered Netdata improperly authenticated API keys. An attacker could possibly use this issue to     leak sensitive information or execute arbitrary code. This issue only affected Ubuntu 20.04 LTS and

    Ubuntu 22.04 LTS. (CVE-2023-22497)

    It was discovered Fluent Bit, vendored in Netdata, incorrectly handled parsing HTTP payloads. An attacker     could possibly use this issue to disrupt logging. This issue only affected Ubuntu 24.10. (CVE-2024-23722)

    It was discovered that WebAssembly Micro Runtime, vendored in Netdata, incorrectly handled memory. An     attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu     24.10. (CVE-2024-34250, CVE-2024-34251)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:1603-1 advisory.

  - An issue was discovered in Netdata 1.10.0. JSON injection exists via the api/v1/data tqx parameter because     of web_client_api_request_v1_data in web/api/web_api_v1.c. (CVE-2018-18836)

  - An issue was discovered in Netdata 1.10.0. HTTP Header Injection exists via the api/v1/data filename     parameter because of web_client_api_request_v1_data in web/api/web_api_v1.c. (CVE-2018-18837)

  - An issue was discovered in Netdata 1.10.0. Log Injection (or Log Forgery) exists via a %0a sequence in the     url parameter to api/v1/registry. (CVE-2018-18838)

  - ** DISPUTED ** An issue was discovered in Netdata 1.10.0. Full Path Disclosure (FPD) exists via     api/v1/alarms. NOTE: the vendor says is intentional. (CVE-2018-18839)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
214875	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.10 : Netdata vulnerabilities (USN-7250-1)	Nessus	Ubuntu Local Security Checks	critical
156215	openSUSE 15 Security Update : netdata (openSUSE-SU-2021:1603-1)	Nessus	SuSE Local Security Checks	high
149569	openSUSE Security Update : netdata (openSUSE-2021-647)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2018-18837

medium

Tenable Plugins

critical

high

high