CVE-2021-41090: Instance config inline secret exposure in Grafana
Summary
CVE-2021-41090: Instance config inline secret exposure in Grafana. Affects github.com/grafana/agent versions >= 0.14.0, < 0.21.2. Fixed in 0.21.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Grafana Agent is an open-source project written in Go that serves as a metrics collector and forwarder for Prometheus. It allows users to collect and send metrics from various sources to a Prometheus Remote Write system. Grafana Agent also supports integrations with other systems and provides functionality for discovering Prometheus targets. It can authenticate against Consul or ETCD for storing configurations in scraping service mode and authenticate against Kafka for receiving traces. However, a vulnerability in Grafana Agent exposes inline secrets in plaintext over the HTTP server, potentially compromising the security of these secrets.
Vulnerability Detail
The vulnerability in Grafana Agent allows inline secrets to be exposed in plaintext over the HTTP server. This includes secrets for metrics instance configs, integrations, Consul ACL tokens, ETCD basic auth, and Kafka receiver for OpenTelemetry-Collector tracing. These secrets are exposed at various endpoints, such as /-/config and /agent/api/v1/configs/{name}. Any user who can reach these endpoints can access the inline secrets, which can be used for delivering metrics, authenticating against systems, and storing configurations. Non-inlined secrets are not affected by this vulnerability. The impact of this vulnerability is moderate, with a CVSS score of 6.5.
How To Fix
Minimum fixed version
0.21.2
This is the first release that contains the fix.
go get github.com/grafana/agent@v0.21.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not possible, it is advised to use non-inline secrets where possible. However, not all configuration options may have a non-inline equivalent. It is also recommended to restrict API access to Grafana Agent by restricting network interfaces it listens on, configuring HTTPS with client authentication, and using firewall rules to restrict external access to the API.
Conclusion
The vulnerability in Grafana Agent exposes inline secrets in plaintext, potentially compromising the security of these secrets. To mitigate this vulnerability, it is recommended to upgrade to the patched version of Grafana Agent and enable the endpoints with caution. If upgrading is not possible, alternative measures such as using non-inline secrets and restricting API access can be implemented. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/grafana/agent →
FAQ
Grafana Agent is an open-source metrics collector and forwarder for Prometheus.
The impact of this vulnerability is moderate, with a CVSS score of 6.5. It allows inline secrets to be exposed in plaintext, potentially compromising the security of these secrets.
To fix this vulnerability, it is recommended to download and install Grafana Agent version v0.20.1 or any version past v0.21.2. These patches obfuscate the impacted secrets from the vulnerable endpoints. Additionally, the patches disable the endpoints by default. To re-enable the endpoints, the --config.enable-read-api command-line flag should be passed.
No, non-inlined secrets such as *_file-based secrets are not impacted by this vulnerability.
If upgrading is not possible, it is advised to use non-inline secrets where possible. However, not all configuration options may have a non-inline equivalent. It is also recommended to restrict API access to Grafana Agent by restricting network interfaces it listens on, configuring HTTPS with client authentication, and using firewall rules to restrict external access to the API.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/grafana/agent.
