CVE-2022-23536CWE-184CWE-641CWE-73

Alertmanager can expose local files content via specially crafted config

Medium · published December 19, 2022

CVSS v3.1
6.5
EPSS
1%
Percentile
56.7
In the wild
Unconfirmed
What it is

Cortex provides multi-tenant, long term storage for Prometheus. A local file inclusion vulnerability exists in Cortex versions 1.13.0, 1.13.1 and 1.14.0, where a malicious actor could remotely read local files as a result of parsing maliciously crafted Alertmanager configurations when submitted to the Alertmanager Set Configuration API. Only users of the Alertmanager service where `-experimental.alertmanager.enable-api` or `enable_api: true` is configured are affected. Affected Cortex users are advised to upgrade to patched versions 1.13.2 or 1.14.1. However as a workaround, Cortex administrators may reject Alertmanager configurations containing the `api_key_file` setting in the `opsgenie_configs` section before sending to the Set Alertmanager Configuration API.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00817 · 56.7th percentile
Weaknesses
CWE-184 · Incomplete List of Disallowed Inputs; CWE-641 · Improper Restriction of Names for Files and Other Resources; CWE-73 · External Control of File Name or Path
Published
2022-12-19T21:10Z
EPSS history
Timeline
  • 19 DEC 21:10Z
    Alertmanager can expose local files content via specially crafted config
    cvelistv5