Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXZ4NTctN2Y0cS1mcGM3
Arbitrary redirects under /new endpoint
Impact
In 2.23.0, Prometheus changed its default UI to the New ui. To ensure a seamless transition, the URL's prefixed by /new redirect to /.
Due to a bug in the code, it is possible for an attacker to craft an URL that can redirect to any other URL, in the /new endpoint.
If a user visits a prometheus server with a specially crafted address (e.g.: http://127.0.0.1:9090/new/new<url>), they can be redirected to an arbitrary URL.
e.g. if a user visits http://127.0.0.1:9090/new/newhttp://www.google.com/, they will be redirected to http://google.com.
Patches
The issue will be patched in 2.26.1 and 2.27.1 releases.
In 2.28.0, the /new endpoint will be removed completely.
Workarounds
The workaround is to disable access to /new via a reverse proxy in front of Prometheus.
Note: Users who use a --web.external-url= flag with a path (e.g. --web.external-url=http://example.com/prometheus) are not affected.
For more information
If you have any questions or comments about this advisory, please use our community channels (https://prometheus.io/community).
Our security policy is available at https://prometheus.io/docs/operating/security/
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXZ4NTctN2Y0cS1mcGM3
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: about 2 years ago
Updated: over 1 year ago
CVSS Score: 6.1
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Identifiers: GHSA-vx57-7f4q-fpc7, CVE-2021-29622
References:
- https://github.com/prometheus/prometheus/security/advisories/GHSA-vx57-7f4q-fpc7
- https://nvd.nist.gov/vuln/detail/CVE-2021-29622
- https://github.com/prometheus/prometheus/releases/tag/v2.26.1
- https://github.com/prometheus/prometheus/releases/tag/v2.27.1
- https://github.com/advisories/GHSA-vx57-7f4q-fpc7
Blast Radius: 22.8
Affected Packages
go:github.com/prometheus/prometheus
Dependent packages: 1,778Dependent repositories: 5,467
Downloads:
Affected Version Ranges: = 2.27.0, >= 2.23.0, < 2.26.1
Fixed in: 2.27.1, 2.26.1
All affected versions:
All unaffected versions: 0.35.0, 0.36.0, 0.36.1, 0.36.2, 0.37.0, 0.37.1, 0.37.2, 0.37.3, 0.37.4, 0.37.5, 0.37.6, 0.37.7, 0.37.8, 0.37.9, 0.38.0, 0.39.0, 0.39.1, 0.39.2, 0.40.0, 0.40.1, 0.40.2, 0.40.3, 0.40.4, 0.40.5, 0.40.6, 0.40.7, 0.41.0, 0.42.0, 0.43.0, 0.43.1, 0.44.0, 0.45.0, 0.45.1, 0.45.2, 0.45.3, 0.46.0, 0.47.0, 0.47.1, 0.47.2, 0.48.0, 0.48.1, 0.49.0, 0.49.1, 1.0.0, 1.0.1, 1.0.2, 1.1.0, 1.1.1, 1.1.2, 1.1.3, 1.2.0, 1.2.1, 1.2.2, 1.2.3, 1.3.0, 1.3.1, 1.4.0, 1.4.1, 1.5.0, 1.5.1, 1.5.2, 1.5.3, 1.6.0, 1.6.1, 1.6.2, 1.6.3, 1.7.0, 1.7.1, 1.7.2, 1.8.0, 1.8.1, 1.8.2, 1.99.0, 2.0.0, 2.1.0, 2.2.0, 2.2.1, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 2.4.1, 2.4.2, 2.4.3, 2.5.0