CVE-2021-31232: Improper input validation in CNCF Cortex
Summary
CVE-2021-31232: Improper input validation in CNCF Cortex. Affects github.com/cortexproject/cortex versions < 1.8.1. Fixed in 1.8.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
CNCF Cortex is an open-source project written in Go that provides a horizontally scalable, highly available, and multi-tenant Prometheus implementation. It is designed to store and query large amounts of time series data efficiently. Cortex includes an Alertmanager component that handles alerts generated by Prometheus and sends notifications to various receivers. This vulnerability affects versions prior to 1.8.1 of CNCF Cortex.
Vulnerability Detail
The Alertmanager in CNCF Cortex before 1.8.1 is vulnerable to improper input validation. When the -experimental.alertmanager.enable-api flag is enabled, an attacker can exploit this vulnerability to disclose local files. By leveraging the HTTP basic auth password_file, an attacker can send any file content via a webhook. Additionally, the alertmanager templates can be manipulated to send any file content, as the alertmanager can load any text file specified in the templates list. This vulnerability has a CVSS score of 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
How To Fix
Minimum fixed version
1.8.1
This is the first release that contains the fix.
go get github.com/cortexproject/cortex@v1.8.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by upgrading to the latest version of CNCF Cortex.
Conclusion
In conclusion, the Alertmanager component in CNCF Cortex before version 1.8.1 is vulnerable to improper input validation, allowing an attacker to disclose local files and send arbitrary file content. To mitigate this vulnerability, it is crucial to upgrade to the latest version of CNCF Cortex. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/cortexproject/cortex →
FAQ
CNCF Cortex is an open-source project that provides a scalable and highly available Prometheus implementation for storing and querying time series data.
The Alertmanager is a component of CNCF Cortex that handles alerts generated by Prometheus and sends notifications to various receivers.
This vulnerability allows an attacker to disclose local files and send arbitrary file content via a webhook. It can potentially lead to unauthorized access to sensitive information.
The CVSS score of this vulnerability is 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
To fix this vulnerability, it is recommended to upgrade to version 1.8.1 or later of CNCF Cortex.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/cortexproject/cortex.
