NetBird v0.76.0

Security

Fixes a local privilege escalation in the client daemon (https://github.com/netbirdio/netbird/security/advisories/GHSA-qcpp-8vwj-hhwr). The daemon's local control interface accepted any local caller without authentication, so an unprivileged user on the same machine could enable the embedded SSH server, turn on SSH root login and disable SSH authentication, and then open a root shell. Every version from 0.5.0 to 0.75.1 is affected: on Linux, macOS and FreeBSD through the world-writable Unix socket, and on Windows through the loopback TCP listener, which carried no caller identity at all. Reported by @neewek.

The daemon now derives each local caller's identity from the kernel and requires root, or an administrator on Windows, to enable the SSH server, enable SSH root login, disable SSH authentication, or to change the management URL or deregister the peer while that profile has the SSH server enabled. On Windows it serves a named pipe instead of loopback TCP, and existing installations are migrated automatically.

Upgrade note: if you enable any of those settings from a script or an unprivileged session, run the command with sudo, or from an elevated prompt on Windows. Turning them off is unchanged, and so is everything else on the socket.

Learn more here

What's Changed

• [management] Force routing-peer DNS resolution for reverse-proxy domain targets by @lixmal in https://github.com/netbirdio/netbird/pull/6872
• [management] Read reverse-proxy service and target columns in Postgres path by @lixmal in https://github.com/netbirdio/netbird/pull/6886
• [client] Expose RenameProfile in the Android profile manager binding by @pappz in https://github.com/netbirdio/netbird/pull/6926
• [client] Build UI release binaries with the production tag by @pappz in https://github.com/netbirdio/netbird/pull/6898
• [client] Escape dots in interface names for sysctl configuration by @stefan-fast in https://github.com/netbirdio/netbird/pull/6930
• [client] Serialize iOS tunnel reconfiguration callbacks by @pappz in https://github.com/netbirdio/netbird/pull/6870
• [client] Unify route selection in the route manager by @pappz in https://github.com/netbirdio/netbird/pull/6928
• [client] parse NB_LAZY_CONN_INACTIVITY_THRESHOLD as a Go duration by @riccardomanfrin in https://github.com/netbirdio/netbird/pull/6947
• [client] Export peer details for Android by @pappz in https://github.com/netbirdio/netbird/pull/6925
• [management] explicit accountID check when deleting a user by @pascal-fischer in https://github.com/netbirdio/netbird/pull/6944
• [infrastructure] Deprecate legacy Dex and Zitadel getting-started scripts by @TechHutTV in https://github.com/netbirdio/netbird/pull/6952
• [client] Fix UI crash on Windows builds without dark-mode support by @lixmal in https://github.com/netbirdio/netbird/pull/6958
• [signal] make pprof configurable by @pascal-fischer in https://github.com/netbirdio/netbird/pull/6963
• [client] Authorize daemon IPC callers by their local identity by @lixmal in https://github.com/netbirdio/netbird/pull/6967

New Contributors

• @stefan-fast made their first contribution in https://github.com/netbirdio/netbird/pull/6930
• @TechHutTV made their first contribution in https://github.com/netbirdio/netbird/pull/6952

Full Changelog: https://github.com/netbirdio/netbird/compare/v0.75.1...v0.76.0