CVE-2021-36157: Path traversal vulnerability in Grafana Cortex
Summary
CVE-2021-36157: Path traversal in Grafana Cortex. Affects github.com/cortexproject/cortex versions < 1.9.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Grafana Cortex is an open-source project written in Go that provides a horizontally scalable, highly available, and multi-tenant Prometheus implementation. It is designed to store and query large amounts of time series data. Cortex utilizes the X-Scope-OrgID header value to construct file paths for rules files. This vulnerability allows an attacker to conduct directory traversal by crafting a malicious OrgID header value, potentially leading to information disclosure.
Vulnerability Detail
The vulnerability in Grafana Cortex (versions up to 1.9.0) arises from the improper handling of the X-Scope-OrgID header value. By manipulating this value to include directory traversal sequences like '../' in the pathname, an attacker can trick Cortex into attempting to parse a rules file located in an unintended directory. If successful, the error message generated by Cortex may include some of the contents of the rules file, potentially exposing sensitive information. It is worth noting that while other Cortex API requests can also be exploited with a malicious OrgID header, the impact is limited to nuisance rather than information disclosure.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, organizations can consider implementing input validation and sanitization mechanisms to ensure that the X-Scope-OrgID header value does not contain any directory traversal sequences. Additionally, monitoring and logging mechanisms can be put in place to detect any suspicious activity related to the vulnerability.
Conclusion
The path traversal vulnerability in Grafana Cortex (CVE-2021-36157) allows an attacker to manipulate the X-Scope-OrgID header value to conduct directory traversal and potentially gain access to sensitive information. It is crucial to upgrade to a version of Grafana Cortex that is not affected by this vulnerability to mitigate the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/cortexproject/cortex →
FAQ
Grafana Cortex is an open-source project that provides a horizontally scalable, highly available, and multi-tenant Prometheus implementation. It is designed to store and query large amounts of time series data.
This vulnerability allows an attacker to conduct directory traversal and potentially gain access to sensitive information stored in rules files. However, the impact can be limited to nuisance if exploited through other Cortex API requests.
To fix this vulnerability, it is recommended to upgrade to a version of Grafana Cortex that is not affected by the issue. The vulnerability has been addressed in versions after 1.9.0.
As a temporary workaround, organizations can implement input validation and sanitization mechanisms to prevent the X-Scope-OrgID header value from containing directory traversal sequences. Monitoring and logging mechanisms can also be useful in detecting any suspicious activity related to the vulnerability.
At the time of this report, no public exploit has been disclosed for this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/cortexproject/cortex.
