CVE-2021-36157

An issue was discovered in Grafana Cortex through 1.9.0. The header value X-Scope-OrgID is used to construct file paths for rules files, and if crafted to conduct directory traversal such as ae ../../sensitive/path/in/deployment pathname, then Cortex will attempt to parse a rules file at that location and include some of the contents in the error message. (Other Cortex API requests can also be sent a malicious OrgID header, e.g., tricking the ingester into writing metrics to a different location, but the effect is nuisance rather than information disclosure.)

CVSS v3 5.3 MEDIUM
CVSS v2.0 5.0 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://github.com/cortexproject/cortex/pull/4375	Patch Third Party Advisory
https://grafana.com/docs/grafana/latest/release-notes/	Release Notes Vendor Advisory
https://github.com/cortexproject/cortex/pull/4375	Patch Third Party Advisory
https://grafana.com/docs/grafana/latest/release-notes/	Release Notes Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:linuxfoundation:cortex:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2021-08-03 15:15

Updated : 2024-11-21 06:13

NVD link : CVE-2021-36157

Mitre link : CVE-2021-36157

CVE.ORG link : CVE-2021-36157

JSON object : View

Products Affected

linuxfoundation

cortex

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2021-36157", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2021-08-03T15:15:08.667", "references": [{"url": "https://github.com/cortexproject/cortex/pull/4375", "tags": ["Patch", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://grafana.com/docs/grafana/latest/release-notes/", "tags": ["Release Notes", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/cortexproject/cortex/pull/4375", "tags": ["Patch", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://grafana.com/docs/grafana/latest/release-notes/", "tags": ["Release Notes", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in Grafana Cortex through 1.9.0. The header value X-Scope-OrgID is used to construct file paths for rules files, and if crafted to conduct directory traversal such as ae ../../sensitive/path/in/deployment pathname, then Cortex will attempt to parse a rules file at that location and include some of the contents in the error message. (Other Cortex API requests can also be sent a malicious OrgID header, e.g., tricking the ingester into writing metrics to a different location, but the effect is nuisance rather than information disclosure.)"}, {"lang": "es", "value": "Se ha detectado un problema en Grafana Cortex versiones hasta 1.9.0. El valor del encabezado X-Scope-OrgID es usado para dise\u00f1ar rutas de archivos para los archivos de reglas, y si se dise\u00f1a para realizar un salto de directorio tal y como ae ../../sensitive/path/in/deployment pathname, Cortex intentar\u00e1 analizar un archivo de reglas en esa ubicaci\u00f3n e incluir\u00e1 parte del contenido en el mensaje de error. (Otras peticiones de la API de Cortex tambi\u00e9n pueden ser enviados un encabezado OrgID malicioso, por ejemplo, enga\u00f1ando al ingester para que escriba las m\u00e9tricas en una ubicaci\u00f3n diferente, pero el efecto es de molestia m\u00e1s que de revelaci\u00f3n de informaci\u00f3n)"}], "lastModified": "2024-11-21T06:13:13.227", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:linuxfoundation:cortex:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E141A48F-DD44-491F-BBBB-70B4945A0A0A", "versionEndIncluding": "1.9.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}