PT-2024-22616 · Unknown · Swift Prometheus

Jonas Dörr

·

Published

2024-03-29

·

Updated

2024-04-01

·

CVE-2024-28867

CVSS v3.1

7.4

High

VectorAV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
Name of the Vulnerable Software and Affected Versions Swift Prometheus versions prior to 2.0.0-alpha.2
Description The issue arises when un-sanitized string values are applied into metric names or labels, allowing an attacker to send a ?lang query parameter with newlines, } or similar characters. This can lead to the attacker taking over the exported format, including creating unbounded numbers of stored metrics, inflating server memory usage, or causing "bogus" metrics. Developers must validate user input before using it as metric names, label names, or values to prevent such attacks.
Recommendations For versions prior to 2.0.0-alpha.2, update to version 2.0.0-alpha.2 or later to fix the vulnerability. As a temporary workaround, consider validating label values and metric names to prevent malicious input. Developers can configure the PrometheusSanitizer to apply custom validation logic. For example, create a custom sanitizer:
let mySanitizer = PrometheusSanitizer { metricName, labels in
 // ... your logic here ...
 (metricName, labels)
}
Then, use this sanitizer when creating a PrometheusCollectorRegistry:
let registry = PrometheusCollectorRegistry(sanitizer: mySanitizer)

Exploit

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2024-28867
GHSA-X768-CVR2-345R

Affected Products

Swift Prometheus