GSD-2022-23536

Vulnerability from gsd - Updated: 2023-12-13 01:19
Details
Cortex provides multi-tenant, long term storage for Prometheus. A local file inclusion vulnerability exists in Cortex versions 1.13.0, 1.13.1 and 1.14.0, where a malicious actor could remotely read local files as a result of parsing maliciously crafted Alertmanager configurations when submitted to the Alertmanager Set Configuration API. Only users of the Alertmanager service where `-experimental.alertmanager.enable-api` or `enable_api: true` is configured are affected. Affected Cortex users are advised to upgrade to patched versions 1.13.2 or 1.14.1. However as a workaround, Cortex administrators may reject Alertmanager configurations containing the `api_key_file` setting in the `opsgenie_configs` section before sending to the Set Alertmanager Configuration API.
Aliases
Aliases
CVE-2022-23536
To clipboard 

{
  "GSD": {
    "alias": "CVE-2022-23536",
    "id": "GSD-2022-23536"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2022-23536"
      ],
      "details": "Cortex provides multi-tenant, long term storage for Prometheus. A local file inclusion vulnerability exists in Cortex versions 1.13.0, 1.13.1 and 1.14.0, where a malicious actor could remotely read local files as a result of parsing maliciously crafted Alertmanager configurations when submitted to the Alertmanager Set Configuration API. Only users of the Alertmanager service where `-experimental.alertmanager.enable-api` or `enable_api: true` is configured are affected. Affected Cortex users are advised to upgrade to patched versions 1.13.2 or 1.14.1. However as a workaround, Cortex administrators may reject Alertmanager configurations containing the `api_key_file` setting in the `opsgenie_configs` section before sending to the Set Alertmanager Configuration API.",
      "id": "GSD-2022-23536",
      "modified": "2023-12-13T01:19:35.132487Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security-advisories@github.com",
        "ID": "CVE-2022-23536",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "cortex",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "=",
                          "version_value": "\u003e= 1.13.0, \u003c= 1.13.1"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "= 1.14.0"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "cortexproject"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Cortex provides multi-tenant, long term storage for Prometheus. A local file inclusion vulnerability exists in Cortex versions 1.13.0, 1.13.1 and 1.14.0, where a malicious actor could remotely read local files as a result of parsing maliciously crafted Alertmanager configurations when submitted to the Alertmanager Set Configuration API. Only users of the Alertmanager service where `-experimental.alertmanager.enable-api` or `enable_api: true` is configured are affected. Affected Cortex users are advised to upgrade to patched versions 1.13.2 or 1.14.1. However as a workaround, Cortex administrators may reject Alertmanager configurations containing the `api_key_file` setting in the `opsgenie_configs` section before sending to the Set Alertmanager Configuration API."
          }
        ]
      },
      "impact": {
        "cvss": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "cweId": "CWE-73",
                "lang": "eng",
                "value": "CWE-73: External Control of File Name or Path"
              }
            ]
          },
          {
            "description": [
              {
                "cweId": "CWE-184",
                "lang": "eng",
                "value": "CWE-184: Incomplete List of Disallowed Inputs"
              }
            ]
          },
          {
            "description": [
              {
                "cweId": "CWE-641",
                "lang": "eng",
                "value": "CWE-641: Improper Restriction of Names for Files and Other Resources"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://github.com/cortexproject/cortex/security/advisories/GHSA-cq2g-pw6q-hf7j",
            "refsource": "MISC",
            "url": "https://github.com/cortexproject/cortex/security/advisories/GHSA-cq2g-pw6q-hf7j"
          },
          {
            "name": "https://cortexmetrics.io/docs/api/#set-alertmanager-configuration",
            "refsource": "MISC",
            "url": "https://cortexmetrics.io/docs/api/#set-alertmanager-configuration"
          },
          {
            "name": "https://github.com/cortexproject/cortex/releases/tag/v1.13.2",
            "refsource": "MISC",
            "url": "https://github.com/cortexproject/cortex/releases/tag/v1.13.2"
          },
          {
            "name": "https://github.com/cortexproject/cortex/releases/tag/v1.14.1",
            "refsource": "MISC",
            "url": "https://github.com/cortexproject/cortex/releases/tag/v1.14.1"
          }
        ]
      },
      "source": {
        "advisory": "GHSA-cq2g-pw6q-hf7j",
        "discovery": "UNKNOWN"
      }
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "\u003e=1.13.0 \u003c=1.13.1||=1.14.0",
          "affected_versions": "All versions starting from 1.13.0 up to 1.13.1, version 1.14.0",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-937"
          ],
          "date": "2022-12-27",
          "description": "Cortex provides multi-tenant, long term storage for Prometheus. A local file inclusion vulnerability exists in Cortex versions 1.13.0, 1.13.1 and 1.14.0, where a malicious actor could remotely read local files as a result of parsing maliciously crafted Alertmanager configurations when submitted to the Alertmanager Set Configuration API. Only users of the Alertmanager service where `-experimental.alertmanager.enable-api` or `enable_api: true` is configured are affected. Affected Cortex users are advised to upgrade to patched versions 1.13.2 or 1.14.1. However as a workaround, Cortex administrators may reject Alertmanager configurations containing the `api_key_file` setting in the `opsgenie_configs` section before sending to the Set Alertmanager Configuration API.",
          "fixed_versions": [
            "1.13.2",
            "1.14.1"
          ],
          "identifier": "CVE-2022-23536",
          "identifiers": [
            "CVE-2022-23536",
            "GHSA-cq2g-pw6q-hf7j"
          ],
          "not_impacted": "All versions before 1.13.0, all versions after 1.13.1 before 1.14.0, all versions after 1.14.0",
          "package_slug": "go/github.com/cortexproject/cortex",
          "pubdate": "2022-12-19",
          "solution": "Upgrade to versions 1.13.2, 1.14.1 or above.",
          "title": "External Control of File Name or Path",
          "urls": [
            "https://github.com/cortexproject/cortex/security/advisories/GHSA-cq2g-pw6q-hf7j",
            "https://cortexmetrics.io/docs/api/#set-alertmanager-configuration",
            "https://github.com/cortexproject/cortex/releases/tag/v1.13.2",
            "https://github.com/cortexproject/cortex/releases/tag/v1.14.1",
            "https://nvd.nist.gov/vuln/detail/CVE-2022-23536",
            "https://github.com/advisories/GHSA-cq2g-pw6q-hf7j"
          ],
          "uuid": "1021abca-b959-4a0d-9fb6-02e64de7696f"
        },
        {
          "affected_range": "\u003e=1.13.0 \u003c1.13.2||=1.14.0",
          "affected_versions": "All versions starting from 1.13.0 before 1.13.2, version 1.14.0",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-937"
          ],
          "date": "2023-02-09",
          "description": "Cortex provides multi-tenant, long term storage for Prometheus. A local file inclusion vulnerability exists in Cortex versions 1.13.0, 1.13.1 and 1.14.0, where a malicious actor could remotely read local files as a result of parsing maliciously crafted Alertmanager configurations when submitted to the Alertmanager Set Configuration API. Only users of the Alertmanager service where `-experimental.alertmanager.enable-api` or `enable_api: true` is configured are affected. Affected Cortex users are advised to upgrade to patched versions 1.13.2 or 1.14.1. However as a workaround, Cortex administrators may reject Alertmanager configurations containing the `api_key_file` setting in the `opsgenie_configs` section before sending to the Set Alertmanager Configuration API.",
          "fixed_versions": [
            "1.13.2",
            "1.14.1"
          ],
          "identifier": "CVE-2022-23536",
          "identifiers": [
            "GHSA-cq2g-pw6q-hf7j",
            "CVE-2022-23536"
          ],
          "not_impacted": "All versions before 1.13.0, all versions starting from 1.13.2 before 1.14.0, all versions after 1.14.0",
          "package_slug": "go/github.com/cortexproject/cortex/pkg/alertmanager",
          "pubdate": "2022-12-19",
          "solution": "Upgrade to versions 1.13.2, 1.14.1 or above.",
          "title": "Cortex\u0027s Alertmanager can expose local files content via specially crafted config",
          "urls": [
            "https://github.com/cortexproject/cortex/security/advisories/GHSA-cq2g-pw6q-hf7j",
            "https://cortexmetrics.io/docs/api/#set-alertmanager-configuration",
            "https://github.com/cortexproject/cortex/releases/tag/v1.13.2",
            "https://github.com/cortexproject/cortex/releases/tag/v1.14.1",
            "https://nvd.nist.gov/vuln/detail/CVE-2022-23536",
            "https://github.com/cortexproject/cortex/commit/03e023d8b012887b31cc268d0d011b01e1e65506",
            "https://pkg.go.dev/vuln/GO-2022-1175",
            "https://github.com/advisories/GHSA-cq2g-pw6q-hf7j"
          ],
          "uuid": "899922d1-843e-4631-98b0-a3ac5df16c6e"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:linuxfoundation:cortex:1.13.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:linuxfoundation:cortex:1.13.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:linuxfoundation:cortex:1.14.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2022-23536"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Cortex provides multi-tenant, long term storage for Prometheus. A local file inclusion vulnerability exists in Cortex versions 1.13.0, 1.13.1 and 1.14.0, where a malicious actor could remotely read local files as a result of parsing maliciously crafted Alertmanager configurations when submitted to the Alertmanager Set Configuration API. Only users of the Alertmanager service where `-experimental.alertmanager.enable-api` or `enable_api: true` is configured are affected. Affected Cortex users are advised to upgrade to patched versions 1.13.2 or 1.14.1. However as a workaround, Cortex administrators may reject Alertmanager configurations containing the `api_key_file` setting in the `opsgenie_configs` section before sending to the Set Alertmanager Configuration API."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "NVD-CWE-noinfo"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://cortexmetrics.io/docs/api/#set-alertmanager-configuration",
              "refsource": "MISC",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "https://cortexmetrics.io/docs/api/#set-alertmanager-configuration"
            },
            {
              "name": "https://github.com/cortexproject/cortex/security/advisories/GHSA-cq2g-pw6q-hf7j",
              "refsource": "MISC",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://github.com/cortexproject/cortex/security/advisories/GHSA-cq2g-pw6q-hf7j"
            },
            {
              "name": "https://github.com/cortexproject/cortex/releases/tag/v1.13.2",
              "refsource": "MISC",
              "tags": [
                "Release Notes",
                "Third Party Advisory"
              ],
              "url": "https://github.com/cortexproject/cortex/releases/tag/v1.13.2"
            },
            {
              "name": "https://github.com/cortexproject/cortex/releases/tag/v1.14.1",
              "refsource": "MISC",
              "tags": [
                "Release Notes",
                "Third Party Advisory"
              ],
              "url": "https://github.com/cortexproject/cortex/releases/tag/v1.14.1"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 3.6
        }
      },
      "lastModifiedDate": "2022-12-27T18:54Z",
      "publishedDate": "2022-12-19T22:15Z"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.