PT-2022-28195 · Unknown · Prometheus

Published 2022-12-05 · Updated 2022-12-05

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Prometheus versions prior to 2.37.4 Prometheus versions prior to 2.40.4

Description A flaw in the implementation of basic authentication in Prometheus allows attackers who know the hashed password to authenticate against Prometheus. This is possible due to a flaw in the exporter toolkit, which enables an attacker to forge a request and poison the internal cache used for hash computation, making subsequent requests successful. The cache is used to limit side channel attacks.

Recommendations For versions prior to 2.37.4, update to Prometheus 2.37.4 or later. For versions prior to 2.40.4, update to Prometheus 2.40.4 or later. As a temporary workaround, consider restricting access to the hashed password stored on disk to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-303

Related Identifiers

GHSA-4V48-4Q5M-8VX4

Affected Products

Prometheus

References · 5

• https://osv.dev/vulnerability/GHSA-4v48-4q5m-8vx4 · Vendor Advisory
• https://github.com/prometheus/prometheus/security/advisories/GHSA-4v48-4q5m-8vx4 · Note
• https://github.com/prometheus/prometheus/commit/31a2db3ae9c0f4b486b6895973beabc1d1beac93 · Note
• https://github.com/prometheus/prometheus/releases/tag/v2.37.4 · Note
• https://github.com/prometheus/prometheus/releases/tag/v2.40.4 · Note