CrisF: Vulnerability Report - Mina Node Monitor

I’ll add information reported here:
through node js you can get any file from the host
all monitor versions are affected since December 14, 2021 commit 7ee51e82d885af951fcb7ef5f9139d7ebc072d50

  https://github.com/olton/mina-node-monitor/commit/7ee51e82d885af951fcb7ef5f9139d7ebc072d50

This is a feature of the nodejs (actually HTTP protocol), developers using it as a server must take care of security themselves.

  https://github.com/olton/mina-node-monitor/blob/552607a18b3e91e66f7c9e1e14ade1643b23685f/server/index.js#L92

 this code line
he doesn't sanitaze url from ".."
so attacker can get any file from host

Fixed, completely removed the code with this vulnerability

2.1.2

• [x] Server: changed helper timestamp() for arguments order, now first date, second divider - timestamp(date, '-:')
• [x] Server: changed algorithm for analyze command line arguments. Now for config parameter with value you must use format --PARNAME value, format -PARNAME reserved for flags
• [x] Server: send alert when config reloaded

2.1.1

• [x] Christmas Edition
• [x] Server: fixed uptime positions sorting
• [x] Server: added config parameter uptimeUpdateInterval, default amd minimal value is 5 min
• [x] Server: fixed spam for uptime
• [x] Client: fixed for version number

Changelog for 2.1.0

• [x] Server: added interaction with a block height from Mina Explorer
• [x] Server: added interaction with the latest block from Mina Explorer
• [x] Server: changed config for telegram and discord definition, updated functions for sending alerts and price
• [x] Server: removed config parameters telegramToken, telegramChatID, telegramChatIDAlert, discordWebHook
• [x] Server: added config parameters telegram, discord
• [x] Server: added config options for telegram: token, tokenInfo, tokenAlert, chatIDInfo, chatIDAlert
• [x] Server: added config options for discord: webhook, webhookInfo, webhookAlert, botName
• [x] Server: to config parameters alertToTelegram, alertToDiscrod added value PRICE. Parameter price:targets deprecated
• [x] Server: to config parameters alertToTelegram, alertToDiscrod added value REWARDS
• [x] Server: to config parameters alertToTelegram, alertToDiscrod added value UPTIME
• [x] Server: removed config parameter balanceSendInterval
• [x] Server: added config parameter channel:info to define which alerts will send to the info channel
• [x] Server: changed reconnect interval to comparable node from 1s to 30s
• [x] Server: changed parameter comparison. Now this parameter has a new structure
• [x] Server: added response for Monitor Version
• [x] Server: added watcher for config file
• [x] Server: config parameters memAlert, memRestart deprecated. You must use new parameters: memory:alert, memory:restart
• [x] Server: config parameters hangIntervalAlert, hangInterval deprecated. You must use new parameters: hang:alert, hang:restart
• [x] Server: added response about server start mode https with value true or false
• [x] Server: added support for static files for webserver
• [x] Server: added config parameter webRoot. With this parameter you can set a webRoot folder other than default (the same where the monitor is installed)

What’s new in 2.1.0

• [x] In the new version returned interaction with a Mina Explorer. Now, Monitor sends a request to the Mina Explorer for information about the last canonical block and blockchain height.
• [x] Changes have been made to the config file structure to make it clearer, and to support new features. I changed parameters which respond to interaction with messengers (Discord and Telegram), interaction with others nodes where Monitor installed (comparison nodes), parameters, which defines a behavior of the Monitor for control memory usage and node hanging state.
• [x] Added new usefulness messages to messengers about won blocks, about uptime changes in the leaderboard.
• [x] Changed algorithm sending information about balance state. Now, information is sent only when the balance was changed. So, parameter balanceSendInterval deprecated, and for enabling balance state sending you must add value BALANCE to the alertToTelegram or alertToDiscord.
• [x] Added a special observer for config file changing. Now, if you change a config.json file content, Monitor applies new values on the fly.
• [x] Now, the server sends the protocol mode (HTTP or HTTPS) to the clients, and this mode is displayed as a closed lock on the left corner in each node panel (in Cluster client).
• [x] Added support for using additional static HTML files in an internal web-server.

Interaction with Mina Explorer

For Interaction with Mina Explorer a special module was added. You can control this module with a composite parameter explorer.

{
        "explorer": {
            "getRewardsInterval": "3m",
            "getLatestBlocksInterval": "1m",
            "getBlockchainSummaryInterval": "1m"
        }
}

Параметры:

• getRewardsInterval - this key responsible for how often Monitor will ask information about won blocks in current epoch.
• getLatestBlocksInterval - this key responsible for how often Monitor will ask information about the latest canonical block in blockchain.
• getBlockchainSummaryInterval - this key responsible for how often Monitor will ask blockchain summary info.

Changing in alert system

Parameters responsible for organization information users to Telegram and/or to Discord were reorganized for simplification and clearing from one side, and for ability to control new features. The next parameters were deprecated: telegramToken, telegramChatID, telegramChatIDAlert`, discordWebHook. Added composite parameters instead telegram and discord. Also was added parameter channel:info for defining messages, which Monitor sends to INFO channel, others messages Monitor will send to ALERT channel. Now, you can divide messages between INFO and ALERT channels and send them to different chats.

telegram

{
    “telegram”: {
        “token”: “”,
        “tokenInfo”: “”,
        “tokenAlert”: “”,
        “chatIDInfo”: “”,
        “chatIDAlert”: “”
    }
}

discord

{
    “discord”: {
        “webhook”: “”,
        “webhookInfo”: “”,
        “webhookAlert”: “”,
        “botName”: “”
    }
}

channel

{
    “channel”: {
        “info”: ["HELLO", "BALANCE", "PRICE", "REWARDS", "UPTIME"]
    }
}

Messages types

    const defaultAlerts = [
        "FAIL",
        "EXEC",
        "HELLO",
        "STATUS",
        "MAX",
        "FORWARD-MAX",
        "FORK",
        "FORWARD-FORK",
        "HANG",
        "EXPLORER",
        "RESTART",
        "BALANCE",
        "PEERS",
        "MEM",
        "COMPARE",
        "PRICE",
        "REWARDS",
        "UPTIME"
    ]

Channel defining

Starting from Monitor 2.1.0 you can use one or two different channels (one for INFO messages, and one for ALERTS) for sending messages from Monitor. If you are only going to use one channel, you can define Telegram token in key token in parameter telegram, and Discord chat webhook in key webhook in parameter discord. If you wish to use different channels, you can define values for keys tokenInfo, tokenAlert, webhookInfo, and webhookAlert. Also, for sending messages to Telegram, you must define users IDs in keys chatIDInfo and/or chatIDAlert. If you wish to send and info messages and alerts to the user, you must put the user chat id to both keys or use merging key chatID.

Split messages to different types

You can split messages to two different types: info and alert. For this purpose you can use parameter channel:info. In the key info of the parameter channel, you must define those messages that are delivered into the info channel. Other messages the Monitor will send to the alert channel. By default, this key contains the following values: "HELLO", "BALANCE", "PRICE", "REWARDS", "UPTIME".

Control the Node hanging state

For a more convenient and understandable perception of the parameters responsible for the behavior of the Monitor in the event of a node hanging detection, next parameter were deprecated hangIntervalAlert, hangInterval. To set Monitor behavior you must use a composite parameter hang with keys alert and restart.

{
    “hang”: {
        “alert”: “30m”,
        “restart”: “60m”
    }
}

Control memory usage

For a more convenient and understandable perception of the parameters responsible for the behavior of the Monitor in the event of a node memory usage detection, next parameter were deprecated memAlert, memRestart. To set Monitor behavior, you must use a composite parameter memory with keys alert and restart.

{
    “memory”: {
        “alert”: 95,
        “restart”: 0
    }
}

Interaction with others Mina Monitors

Beginning from version 2.0.2 Monitor receives a module for interaction with other Mina Monitor instances. This module can control matching block heights and inform you in case when height is different. In 2.1.0 the structure of parameters for this module was changed to:

{
    "comparison": {
        "reconnect": "30s",
        "blockDiff": 3,
        "nodes": [
            {
                "name": "Host1",
                "address": "host1.com:8000",
                “https”: false
            },
            {
                "name": "Host2",
                "address": "host2.com:8000",
                “https”: false
            }
        ]
    }
}

Attention! Interaction with other nodes may work incorrectly or not work at all if you have self-signed certificates installed or ssl certificates are installed incorrectly (incomplete chains, ...).

New messages

In 2.1.0 new information messages: 1) info about won blocks, 2) changes for your address in uptime leaderboard, 3) information about Mina cost. To activate these messages, you must add values PRICE, UPTIME, REWARDS to the parameter alertToTelegram and/or to the parameter alertToDiscord.

Note: it is necessary to take into account that the price:target parameter is canceled.

Config file watcher

In 2.1.0 added a module that monitors the state of the configuration file (config.json) and if any changes are made to it, this module applies these changes to the Monitor. With this, you no longer need to restart the monitor. You can change any parameter without restarting the Monitor, except for the parameters host, https, journal.

This functionality does not work yet with a Monitor running as a Docker Container.

HTTP or HTTPS

Now Monitor sends to clients information about protocol where he works. If the Monitor was started in secure mode (with using SSL certificate on HTTPS protocol), On the client (supported only in Cluster Client) you can see that on the top left corner on the node panel.

Supports static HTML files

In 2.1.0 was added support for using static html files on the level of the internal web server. You can control a place of the web server root folder with a parameter webRoot. You can use this feature to create and renew Let’s Encrypt certificate in automatic mode (if you use 80/443 ports to start Monitor).

2.0.2

• [x] Server: added restart by long uptime with config parameter restartAfterUptime. The value must be defined in milliseconds or internal time string format . Default value is 0 (no restart)
• [x] Server: added config parameter name. Now you can define a name for you node, if name is not define, Monitor will use a hostname
• [x] Server: improvements for singing messages
• [x] Server: command node index --init now updated config file if one exists
• [x] Server: added config parameter comparison
• [x] Server: added alert with rule COMPARE for alerting when node height is different from comparable nodes
• [x] Server: changed algorithm for memory observing

2.0.1

• [x] Server: fixed snark worker controller for first start, issue #7
• [x] Server: fixed spams when snark worker controller can not start sw
• [x] Server: fixed issue for set telegramChatID from command line

What's new

• [x] Changed data exchange protocol from http(s) to ws(s)
• [x] Added Docker file for server and built docker image (olton/mina_monitor_server)
• [x] To the Server added command line arguments support. Now you can rewrite config parameters with command line arguments
• [x] Refactoring server code, switch to CommonJS modules
• [x] Control for mina stopped with journalctl and write this event to the log
• [x] New supported time format for config parameters - short string (see README)
• [x] A lot of client config parameters are deprecated: intervals, price, hosts, useHost, useHttps

Changelog

• [x] Server: changed data exchange protocol from http(s) to ws(s)

• [x] Server: added command line arguments support. Now you can rewrite config parameters with command line arguments

• [x] Server: refactoring code, switch to CommonJS modules

• [x] Server: improved alerter for HANG state detecting

• [x] Server: added logic to disable HANG alert/restart when hangInterval, hangIntervalAlert is 0

• [x] Server: added control for mina stopped with journalctl and write this event to the log

• [x] Server: added alert to telegram and/or discord about mina daemon stops by failure (info from journalctl)

• [x] Server: added response for request sync-state. Return daemon sync state (SYNCED, BOOTSTRAP, ...) or UNKNOWN

• [x] Server: added helper function timeParser(t) for parsing time, defined in short string (ex: 1d3h23m45s, 30m, 10s, 2h30s)

• [x] Server: config parameter restartAfterNotSynced must be defined in milliseconds or short time string (ex: 30m)

• [x] Server: changed alerts events to Telegram and Discord. Value NON_SYNCED is deprecated, to alert change sync status use value STATUS

• [x] Server: changed config property price:interval to price:sendInterval

• [x] Server: removed collecting Mina Explorer Height, config parameter observeExplorer deprecated

• [x] Server: config parameter blockDiff now can be 0 to disable fork checking

• [x] Server: config parameter blockDiffToRestart now can be 0 to disable restart node when fork detected

• [x] Client: changed data exchange protocol from http(s) to ws(s)

• [x] Client: added support short string time format in config

• [x] Client: config parameters inervals:* are deprecated

• [x] Client: config parameters price:* are deprecated

• [x] Client: config parameters proxy, useProxy are deprecated

• [x] Client: config parameters hosts, useHost are deprecated. You must use parameter host: "server_ip_or_name:port"

• [x] Client: config parameter useHttps are deprecated. You must use parameter https: true|false

• [x] Client: fixed color for uptime position label for 120+ places

What's new in 1.1.4

• [x] Snark worker controller
• [x] Node response time

Changelog for 1.1.4

• [x] Server: added snark worker controller
• [x] Server: added request for node response time
• [x] Server: improved work of the alerter for detecting forks
• [x] Server: use stored state for responses
• [x] Client: updated for using new responses

1.1.3

• [x] Server: fixed exception alert in uptime module when service is down

1.1.2

• [x] Fixed memory leaks for setTimeout circular links
• [x] Server: added process.memory to get mem request

What's new in 1.1.1

• [x] New algorithm to check node hanging
• [x] New alert for NO PEERS state
• [x] health object for the node to display node health on the client (OK, FORK, UNKNOWN, NO PEERS, NOT-SYNCED).
• [x] Many changes for improving work of the server-side
• [x] Alert and restart node if Critical memory usage state detected
• [x] Can be used for Mina Monitor Cluster

Changes in 1.1.1

• [x] Server: improved alerts for FORK states

• [x] Server: added alert for NO PEERS state

• [x] Server: node info now stored into local object every time interval defined in consfig.nodeInfoCollectInterval

• [x] Server: added config property config.blockSpeedDistance with default value 10 to calculate blockchain speed

• [x] Server: information about mina now return from stored object

• [x] Server: added request for node health, request return empty array if OK or filled array with critical states

• [x] Server: alerter now use stored node info

• [x] Server: improved alerts for HANG state

• [x] Server: added config properties hangInterval, hangIntervalAlert, config option restartAfterPrev is deprecated, use hangInterval

• [x] Server: added config options memAlert, memRestart as a percent value (0 - 100)

• [x] Client: added reaction for node health request

• [x] Client: Node health now is displaying in sync status block

What's new 1.0.5 -> 1.1.0

• [x] Alert to Discord
• [x] Define which alerts will send to telegram or discord
• [x] Reorder blocks with config.blocks
• [x] Optimized config files. Configs changed! Read readme and changeloag
• [x] New visual (soft changes)
• [x] Changed rules to restart, now node will restart if value in block difference reached
• [x] Send price info to telegram/discord
• [x] Request to COINGECKO moved from client to server

Changelog 1.0.5 -> 1.1.0

• [x] Server: fixed uptime sender for using publicKeyDelegators

• [x] Server: fixed alerter module for forward for when unvalidated length is 0

• [x] Server: changed possible values for config.restartStateSyncedRules to ["MAX", "FORK", "FORWARD-FORK", "HANG"]

• [x] Server: config props restartAfterMax, restartAfterUnv is deprecated, use blockDiffToRestart

• [x] Server: added alert to DISCORD (used discord webhooks)

• [x] Server: added config props alertToTelegram, alertToDiscord. Possible values: ["NOT-SYNCED", "MAX", "FORK", "FORWARD-FORK", "HANG", "EXPLORER", "RESTART", "BALANCE"]

• [x] Server: moved request to coingecko from client to server

• [x] Server: added config.price parameter

• [x] Client: added flashing for maxHeight, unvalidateHeight, explorerHeight when difference present with the current height

• [x] Client: high/low price now showing all-time high/low

• [x] Client: added price change in currency, added colored arrow for indicate price change

• [x] Client: next config props deprecated and not used: cpu, net, mem, blockchain, node, info, time

• [x] Client: added new config props: system (server info and time), resources (cpu, net, ram), daemon (data from Mina GraphQL: node info, blockchain status)

• [x] Client: changed CPU temperature view

• [x] Client: changed block height view

• [x] Client: added border radius to panels

• [x] Client: progress bar for epoch now showing time left

• [x] Client: added config check. If config contains errors, Monitor puts to the console error message

• [x] Client: reorder blocks with config.blocks option

• [x] Client: optimized build scripts. (Important, required npm i)

What's new

• [x] Delegations info
• [x] Rewards in current epoch info
• [x] Mina price info
• [x] Calculate balance in USD
• [x] Check for forward fork

Changes

1.0.4

• [x] Server: added request for delegators

• [x] Server: added new config props publicKeyDelegators

• [x] Server: added check for chain exist in node.mjs:getBlockSpeed()

• [x] Server: added check for forward fork (block height more than unvalidated)

• [x] Server: added request to Explorer GraphQL to get won blocks for current epoch

• [x] Client: show delegations count and total stack for current and next epoch

• [x] Client: added price data from coingecko.com

• [x] Client: change style for scrollbars

• [x] Client: new config props price: {currency, interval}

• [x] Client: updated uptime, the position value now more pronounced

• [x] Client: fixed using dark theme

• [x] Client: added won blocks for current epoch into EPOCH panel

1.0.3

• [x] Server: The node will don't more restart is the block height different from Explorer.

• [x] Server: Alert for difference height to Explorer height now enabled/disabled with config parameter observeExplorer

• [x] Server: For restart in not SYNCED now uses parameter restartAfterNotSynced from config file.

• [x] Server: The Node will not restart when non-synced for states defined in config parameter restartStateException. This is an array. Recommended set it to ["BOOTSTRAP"].

• [x] Server: Changed rules for restart node in synced. Added rules for difference with max block length, unvalidated block length, and equal to previous block height

• [x] Server: Removed config parameter redtartAfter

• [x] Server: Now you must use parameters restartAfterMax, restartAfterUnv, restartAfterPrev (restartAfterMax, restartAfterUnv parameters must have value in minutes, restartAfterPrev - integer, how many times the alert must go off before the mine is restarted)

• [x] Server: You can enable restart rules for synced mode with the config parameter restartStateSyncedRules. This parameter must have value as an array and can contain the next values: ['MAX', 'UNV', 'PREV']

• [x] Server: Added alerts to telegram for: difference block height from max block and unvalidated block, and equals to previous retrieved block height

• [x] Client: Split RAM usage chart to two separate charts: free, usage.

• [x] Client: Block producer and snark worker now have a short name, you can click on these to copy to clipboard full name.

• [x] Client: Added block speed, showed in BLOCK HEIGHT panel

• [x] Client: Fixed work with server if one started on https. To config added key useHttps with true or false values.

• [x] Client: Fixed network chart for align max value and split to two different charts

1.0.2

• [x] Added cpu threads load chart
• [x] Re-disposition RAM and CPU panels content
• [x] Added https server creation. Use server conf option https to set paths to cert and key
• [x] Added dark/light modes
• [x] Visual improvements

Mina Monitor is an extended graphical version of the mina client status command with additional indicators.

What's new:

1. Restarting Node if this operation granted and require
2. Added simple proxy-server, written on PHP
3. Added uptime position and score from sidecar
4. Visual improves
5. Re-written server code for cpu and ram
6. Added HOW-TO (RU, EN)

Mina Node Monitor v1.0.0

Mina Node Monitor is an extended graphical version of themina client status command with additional indicators. This is a client-server application for visual monitoring of the validator node and alerts when the node has a problem.

Key Features

1. Track the status of a node in real-time
2. Shows 12 parameters: status, uptime, balance, ...
3. Shows the load on memory, processor, network
4. Monitors the state of the node and, if the node is out of sync with the main network and/or has switched in a status other than SYNCED, sends notifications to Telegram