Alertmanager can expose local files content via specially crafted config
Summary
Alertmanager can expose local files content via specially crafted config
Original description
The description as published by the source.
Cortex provides multi-tenant, long term storage for Prometheus. A local file inclusion vulnerability exists in Cortex versions 1.13.0, 1.13.1 and 1.14.0, where a malicious actor could remotely read local files as a result of parsing maliciously crafted Alertmanager configurations when submitted to the Alertmanager Set Configuration API. Only users of the Alertmanager service where -experimental.alertmanager.enable-api or enable_api: true is configured are affected. Affected Cortex users are advised to upgrade to patched versions 1.13.2 or 1.14.1. However as a workaround, Cortex administrators may reject Alertmanager configurations containing the api_key_file setting in the opsgenie_configs section before sending to the Set Alertmanager Configuration API.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- web cortexmetrics.io
- web github.com
- web github.com