PT-2021-23081 · Grafana · Grafana Agent

Rfratto · Published 2021-12-08 · Updated 2024-08-21 · CVE-2021-41090

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Grafana Agent versions prior to 0.20.1 and 0.21.2

Description The issue concerns the exposure of inline secrets in plaintext over two endpoints: /-/config for metrics instance configs defined in the base YAML file and /agent/api/v1/configs/:key for metrics instance configs defined for the scraping service. These secrets are used for delivering metrics to a Prometheus Remote Write system, authenticating against a system for discovering Prometheus targets, and authenticating against a system for collecting metrics. The exposure occurs when HTTPS with client authentication is not configured, making the endpoints accessible to unauthenticated users. Non-inlined secrets, such as * file based secrets, are not impacted.

Recommendations For versions prior to 0.20.1 and 0.21.2, use non-inline secrets where possible. Restrict API access to Grafana Agent by restricting the network interfaces it listens on through http listen address in the server block. Configure Grafana Agent to use HTTPS with client authentication. Use firewall rules to restrict external access to Grafana Agent's API. Upgrade to version 0.20.1 or any version past 0.21.2 to patch the issue.

Fix

Cleartext Storage of Sensitive Information

Information Disclosure

Weakness Enumeration

CWE-312

CWE-200

Related Identifiers

CVE-2021-41090

GHSA-9C4X-5HGQ-Q3WH

GO-2022-0305

Affected Products

Grafana Agent

References · 14

• https://github.com/grafana/agent/commit/af7fb01e31fe2d389e5f1c36b399ddc46b412b21 · Patch
• https://github.com/grafana/agent/pull/1152 · Patch
• https://osv.dev/vulnerability/GO-2022-0305 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41090 · Security Note
• https://osv.dev/vulnerability/CVE-2021-41090 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9c4x-5hgq-q3wh · Vendor Advisory
• https://github.com/grafana/agent/releases/tag/v0.20.1 · Note
• https://github.com/grafana/agent/releases/tag/v0.21.2 · Note
• https://github.com/grafana/agent/security/advisories/GHSA-9c4x-5hgq-q3wh · Note
• https://github.com/grafana/agent/commit/a5479755e946e5c7cddb793ee9adda8f5692ba11 · Note
• https://github.com/grafana/agent · Note
• https://security.netapp.com/advisory/ntap-20211229-0004 · Note
• https://t.me/cvenotify/24433 · Telegram Post
• https://t.me/cibsecurity/33620 · Telegram Post