PT-2021-19212 · Cncf · Cncf Cortex

Published 2021-04-30 · Updated 2024-08-21 · CVE-2021-31232

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions CNCF Cortex versions prior to 1.8.1

Description The issue concerns a local file disclosure problem in the Alertmanager component when the -experimental.alertmanager.enable-api option is enabled. This allows an attacker to potentially send any file content via a webhook by exploiting the HTTP basic auth password file. Additionally, the alertmanager templates can be used as an attack vector to send any file content because the alertmanager can load any text file specified in the templates list. Improper input validation in CNCF Cortex is also a contributing factor.

Recommendations For versions prior to 1.8.1, update to version 1.8.1 or later to resolve the issue. As a temporary workaround, consider disabling the -experimental.alertmanager.enable-api option until a patch is available. Restrict access to the alertmanager templates to minimize the risk of exploitation. Avoid using the HTTP basic auth password file in the alertmanager configuration until the issue is resolved.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2021-31232

GHSA-M45G-F45X-VV22

GO-2022-0915

Affected Products

Cncf Cortex

References · 9

• https://github.com/cortexproject/cortex/pull/4129/files · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-31232 · Security Note
• https://osv.dev/vulnerability/GHSA-m45g-f45x-vv22 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0915 · Vendor Advisory
• https://lists.cncf.io/g/cortex-users/message/50 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-31232 · Vendor Advisory
• https://github.com/cortexproject/cortex · Note
• https://github.com/advisories/GHSA-m45g-f45x-vv22 · Note
• https://community.grafana.com/c/security-announcements · Note