CVE-2021-29622: Arbitrary redirects under /new endpoint in github.com/prometheus/prometheus
Summary
CVE-2021-29622: Arbitrary redirects under /new endpoint. Affects github.com/prometheus/prometheus across 2 version ranges.
>= 2.23.0, < 2.26.1
>= 2.27.0, < 2.27.1
Fixed in 2.26.1 or 2.27.1, depending on the release line you run. How to fix ↓
Also tracked for
- prometheus · Bitnami
The same CVE-2021-29622 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
github.com/prometheus/prometheus is an open-source monitoring and alerting toolkit for containers and microservices. It provides a time series database, a query language, and a user interface for visualizing and analyzing metrics. The vulnerability identified as CVE-2021-29622 affects versions 2.23.0 to 2.26.1 and 2.27.0 to 2.27.1 of Prometheus. This vulnerability allows an attacker to craft a specially crafted URL that can redirect users to arbitrary URLs when visiting the /new endpoint. This can lead to potential phishing attacks or unauthorized access to sensitive information.
Vulnerability Detail
The vulnerability arises from a bug in the code of Prometheus. When transitioning to the New UI in version 2.23.0, Prometheus introduced a redirect from URLs prefixed by /new to /. However, due to the bug, an attacker can exploit this redirect mechanism to redirect users to any other URL. For example, by visiting a Prometheus server with a specially crafted address like http://127.0.0.1:9090/new/new<url>, the user can be redirected to an arbitrary URL. The impact of this vulnerability can range from phishing attacks to unauthorized access to sensitive information. The issue will be patched in the 2.26.1 and 2.27.1 releases, and the /new endpoint will be completely removed in version 2.28.0.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.23.0, < 2.26.12.26.1go get github.com/prometheus/prometheus@v2.26.1 -
>= 2.27.0, < 2.27.12.27.1go get github.com/prometheus/prometheus@v2.27.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
A workaround for this vulnerability is to disable access to the /new endpoint via a reverse proxy in front of Prometheus. By configuring the reverse proxy to block requests to the /new path, the vulnerability can be mitigated. Users who use the --web.external-url= flag with a path (e.g., --web.external-url=http://example.com/prometheus) are not affected by this vulnerability.
Conclusion
The vulnerability CVE-2021-29622 in github.com/prometheus/prometheus allows for arbitrary redirects under the /new endpoint, potentially leading to phishing attacks or unauthorized access to sensitive information. It is crucial to update Prometheus to version 2.26.1 or 2.27.1, or upgrade to version 2.28.0 to mitigate this vulnerability. Alternatively, disabling access to the /new endpoint via a reverse proxy can serve as a workaround. Regularly updating Prometheus is essential to ensure the latest security patches are applied. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/prometheus/prometheus →
FAQ
The impact of this vulnerability can range from phishing attacks to unauthorized access to sensitive information. An attacker can redirect users to arbitrary URLs, potentially leading to the disclosure of sensitive data or the execution of malicious actions.
To fix this vulnerability, it is recommended to update Prometheus to version 2.26.1 or 2.27.1, depending on the affected version. Alternatively, upgrading to version 2.28.0 will remove the /new endpoint completely. Users can download the latest release from the official Prometheus GitHub repository and follow the installation instructions provided.
Yes, a workaround for this vulnerability is to disable access to the /new endpoint via a reverse proxy in front of Prometheus. By configuring the reverse proxy to block requests to the /new path, the vulnerability can be mitigated. Users who use the --web.external-url= flag with a path (e.g., --web.external-url=http://example.com/prometheus) are not affected by this vulnerability.
Versions 2.23.0 to 2.26.1 and 2.27.0 to 2.27.1 of Prometheus are affected by this vulnerability.
Yes, the CVSS score for this vulnerability is 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/prometheus/prometheus.
