Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.0.0 to before version 2.2.0, the getRedirectURL function in oauth2.go:22-29 constructs the OAuth2 callback URL by concatenating the request's Host header with a fixed path, with zero validation of the Host header. This can result in host header injection. This issue has been patched in version 2.2.0.

Affected: Go: github.com/nezhahq/nezha

## 1. Description

The `getRedirectURL` function in `oauth2.go:22-29` constructs the OAuth2 callback URL by concatenating the request's `Host` header with a fixed path, with **zero validation** of the Host header:

```go func getRedirectURL(c *gin.Context) string { scheme := "http://" referer := c.Request.Referer() if forwardedProto := c.Request.Header.Get("X-Forwarded-Proto"); forwardedProto == "https" || strings.HasPrefix(referer, "https://") { scheme = "https://" } return scheme + c.Request.Host + "/api/v1/oauth2/callback" } ```

**File:** `cmd/dashboard/controller/oauth2.go:22-29`

This function is called from `oauth2redirect()` at line 53: ```go func oauth2redirect(c *gin.Context) (*model.Oauth2LoginResponse, error) { // ... redirectURL := getRedirectURL(c) o2conf := o2confRaw.Setup(redirectURL) // ... url := o2conf.AuthCodeURL(state, oauth2.AccessTypeOnline) return &model.Oauth2LoginResponse{Redirect: url}, nil } ```

The `redirectURL` is passed into `o2confRaw.Setup(redirectURL)` which configures the OAuth2 `Config.RedirectURL` field (`oauth2config.go:22-33`). This `RedirectURL` is sent to the OAuth2 provider (e.g., GitHub, Google, Microsoft) as the callback endpoint. The OAuth2 provider will redirect the user's browser — along with the authorization code — to this URL after the user authenticates.

The security issue is that `c.Request.Host` is directly user-controllable via the HTTP `Host` header. An attacker who c…