HyperDX vulnerabilities

HyperDX through 1.10.1 fails to enforce role-based access controls in team management endpoints, allowing any team member to perform administrative actions. Attackers can delete team members including owners, rotate API keys, and rename teams by sending requests to PATCH /team/apiKey, PATCH /team/name, and DELETE /team/member endpoints.

SSRF vulnerability in HyperDX before version 2.31.0. Authenticated team members can direct the server to arbitrary internal destinations by supplying a caller-controlled host parameter to the ClickHouse proxy test endpoint, without URL validation or allowlist. Attackers can exploit error responses to disclose internal service responses.

HyperDX before version 2.31.0 contains a server-side request forgery (SSRF) vulnerability. Authenticated team members can direct the server to make requests to arbitrary internal network destinations by supplying a caller-controlled URL to the webhook test endpoint. Attackers can bypass insufficient hostname blacklist validation in the webhook handler to enumerate internal services, interact with internal containers, or access cloud instance metadata services including provider metadata endpoints.