admin/netdata: update to >=1.37 — CVE-2023-22496 (Critical RCE) + CVE-2023-22497 (auth bypass) unpatched in v1.33.1

## Security Report: admin/netdata **Package:** `admin/netdata` **Current version in feed:** 1.33.1 (released early 2022) **Fixed in:** Netdata ≥ 1.37 **Architecture:** all (upstream issue, not architecture-specific) --- ### Summary `admin/netdata` is pinned at version **1.33.1**, which is approximately 4 major releases behind the current stable and contains **two publicly disclosed, confirmed CVEs** — one rated Critical (arbitrary command execution) and one rated High (authentication bypass). Both have been fixed since Netdata v1.37 (January 2023). --- ### Finding 1 — CVE-2023-22496: Arbitrary Command Execution via Streaming (Critical) **Severity:** Critical **CWE:** CWE-78 (OS Command Injection) **CVSS:** High **Fixed in:** Netdata 1.37 A vulnerability in how the Netdata agent handles streaming connections allows an attacker to execute arbitrary commands on the system running netdata. This was publicly disclosed in January 2023 and patched in v1.37. On a router, netdata typically runs as root. If exposed to an attacker (LAN or WAN), this results in **full remote code execution with root privileges**. **Reference:** https://nvd.nist.gov/vuln/detail/CVE-2023-22496 --- ### Finding 2 — CVE-2023-22497: Authentication Bypass (High) **Severity:** High **CWE:** CWE-287 (Improper Authentication) **Fixed in:** Netdata 1.37 An attacker with a valid `MACHINE_GUID` can bypass authentication against a Netdata parent node, allowing unauthorized access to monitoring data and streaming cluster management. **Reference:** https://nvd.nist.gov/vuln/detail/CVE-2023-22497 --- ### Finding 3 — Unauthenticated HTTP dashboard on port 19999 (Medium) **Severity:** Medium **CWE:** CWE-306 (Missing Authentication for Critical Function) Netdata exposes a full system metrics dashboard (CPU, RAM, disk, network, processes) on port 19999 with no authentication by default. On an embedded router this enables LAN-wide reconnaissance. The init script does not restrict the bind address. **Suggested mitigation in init script:** ``` # /etc/netdata/netdata.conf [global] bind to = 127.0.0.1 ``` --- ### Reproduction Steps 1. Install `admin/netdata` from the OpenWrt packages feed (version 1.33.1) 2. Check CVE-2023-22496 and CVE-2023-22497 on NVD — both confirm affected range includes < 1.37 3. Confirm `PKG_VERSION` in `admin/netdata/Makefile` is 1.33.1 --- ### Expected Behavior Package should be updated to Netdata ≥ 1.37 (current stable) so that CVE-2023-22496 and CVE-2023-22497 are resolved. --- ### Actual Behavior `PKG_VERSION:=1.33.1` in `admin/netdata/Makefile` — both CVEs remain unpatched. --- ### Recommended Fix Update `admin/netdata/Makefile`: ``` PKG_VERSION:=<latest stable ≥ 1.37> PKG_RELEASE:=1 PKG_HASH:=<updated sha256> ``` Also consider adding a default `netdata.conf` fragment that binds to `127.0.0.1` only. --- ### References - CVE-2023-22496: https://nvd.nist.gov/vuln/detail/CVE-2023-22496 - CVE-2023-22497: https://nvd.nist.gov/vuln/detail/CVE-2023-22497 - Netdata security advisory: https://github.com/netdata/netdata/security/advisories - Netdata changelog: https://github.com/netdata/netdata/releases