Prometheus Exporter Toolkit is a utility package to build exporters. Prior to versions 0.7.2 and 0.8.2, if someone has access to a Prometheus web.yml file and users bcrypted passwords, they can bypass security by poisoning the built-in authentication cache. Versions 0.7.2 and 0.8.2 contain a fix for the issue. There is no workaround, but attacker must have access to the hashed password to use this functionality.
Weakness
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Exporter_toolkit | Prometheus | * | 0.7.2 (excluding) |
| Exporter_toolkit | Prometheus | 0.8.0 (including) | 0.8.2 (excluding) |
| Red Hat OpenShift Container Platform 4.11 | RedHat | openshift4/ose-thanos-rhel8:v4.11.0-202308311243.p0.g99b6e03.assembly.stream | * |
| Red Hat OpenShift Container Platform 4.12 | RedHat | openshift4/ose-thanos-rhel8:v4.12.0-202305022015.p0.g9f2b5ff.assembly.stream | * |
| Red Hat OpenShift Container Platform 4.13 | RedHat | openshift4/ose-kube-state-metrics:v4.13.0-202304190216.p0.g4b96984.assembly.stream | * |
| Red Hat OpenShift Container Platform 4.13 | RedHat | openshift4/ose-prometheus:v4.13.0-202305020815.p0.g8279148.assembly.stream | * |
| Red Hat OpenShift Container Platform 4.13 | RedHat | openshift4/ose-prometheus-alertmanager:v4.13.0-202304190216.p0.gf44d574.assembly.stream | * |
| Red Hat OpenShift Container Platform 4.13 | RedHat | openshift4/ose-prometheus-node-exporter:v4.13.0-202304190216.p0.g10dc380.assembly.stream | * |
| Red Hat OpenShift Container Platform 4.13 | RedHat | openshift4/ose-thanos-rhel8:v4.13.0-202304190216.p0.gb6f11a5.assembly.stream | * |
| Golang-github-prometheus-exporter-toolkit | Ubuntu | esm-apps/jammy | * |
| Golang-github-prometheus-exporter-toolkit | Ubuntu | jammy | * |
| Golang-github-prometheus-exporter-toolkit | Ubuntu | kinetic | * |
| Golang-github-prometheus-exporter-toolkit | Ubuntu | lunar | * |
| Golang-github-prometheus-exporter-toolkit | Ubuntu | trusty | * |
| Golang-github-prometheus-exporter-toolkit | Ubuntu | upstream | * |
| Golang-github-prometheus-exporter-toolkit | Ubuntu | xenial | * |
| Prometheus | Ubuntu | bionic | * |
| Prometheus | Ubuntu | focal | * |
| Prometheus | Ubuntu | kinetic | * |
| Prometheus | Ubuntu | lunar | * |
| Prometheus | Ubuntu | mantic | * |
| Prometheus | Ubuntu | oracular | * |
| Prometheus | Ubuntu | plucky | * |
| Prometheus | Ubuntu | trusty | * |
| Prometheus | Ubuntu | xenial | * |
Potential Mitigations
Related Attack Patterns
- https://cwe.mitre.org/data/definitions/114.html
- https://cwe.mitre.org/data/definitions/115.html
- https://cwe.mitre.org/data/definitions/151.html
- https://cwe.mitre.org/data/definitions/194.html
- https://cwe.mitre.org/data/definitions/22.html
- https://cwe.mitre.org/data/definitions/57.html
- https://cwe.mitre.org/data/definitions/593.html
- https://cwe.mitre.org/data/definitions/633.html
- https://cwe.mitre.org/data/definitions/650.html
- https://cwe.mitre.org/data/definitions/94.html
References
- http://www.openwall.com/lists/oss-security/2022/11/29/1
- http://www.openwall.com/lists/oss-security/2022/11/29/2
- http://www.openwall.com/lists/oss-security/2022/11/29/4
- https://github.com/prometheus/exporter-toolkit/commit/5b1eab34484ddd353986bce736cd119d863e4ff5
- https://github.com/prometheus/exporter-toolkit/security/advisories/GHSA-7rg2-cxvp-9p7p
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JRSHISR64L6QGSMDFZDNPHHIXSCAKK26/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UH24VXIB25OGHF4VGY4PLZMTGTI3BHCA/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ULVDTAI76VATRAHTKCE2SUJ4NC3PQZ6Y/
- https://security.gentoo.org/glsa/202401-15
- http://www.openwall.com/lists/oss-security/2022/11/29/1
- http://www.openwall.com/lists/oss-security/2022/11/29/2
- http://www.openwall.com/lists/oss-security/2022/11/29/4
- https://github.com/prometheus/exporter-toolkit/commit/5b1eab34484ddd353986bce736cd119d863e4ff5
- https://github.com/prometheus/exporter-toolkit/security/advisories/GHSA-7rg2-cxvp-9p7p
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JRSHISR64L6QGSMDFZDNPHHIXSCAKK26/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UH24VXIB25OGHF4VGY4PLZMTGTI3BHCA/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ULVDTAI76VATRAHTKCE2SUJ4NC3PQZ6Y/
- https://security.gentoo.org/glsa/202401-15