Arbitrary file read via Alertmanager receiver configuration in Grafana Mimir
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- Fixed in 2.17.20, 3.1.7, 3.2.2
- Who is exposed
- Not reported
Do first: Upgrade to a fixed version: 2.17.20, 3.1.7, 3.2.2.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- Published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 11/100 · provisional
- Fix
- Fixed in 2.17.20, 3.1.7, 3.2.2
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
Grafana Mimir and Grafana Enterprise Metrics (GEM) are affected. A tenant allowed to upload an Alertmanager configuration could read arbitrary files from the Alertmanager host, such as credentials and configuration files, by pointing HTTP header or basic auth settings at those files and sending notifications to a server they control.
Read the original description
Grafana Mimir's Alertmanager rejects tenant-supplied receiver configurations that reference local files, but the check did not cover two HTTP client settings: http_headers.<name>.files and basic_auth.username_file. A tenant permitted to upload an Alertmanager configuration could point these fields at any file readable by the Alertmanager process. When a notification was sent, Alertmanager read the file and put its contents in a header of the outgoing request. By directing the receiver at a server they control, the tenant could read files from the Alertmanager host, such as credentials and configuration. Exploitation requires permission to write the tenant's Alertmanager configuration. Grafana Enterprise Metrics (GEM), which is built on Mimir, is also affected. The issue is fixed in Mimir 3.1.7 and 3.2.2 and in GEM 2.17.20. GEM 2.11 through 2.16 will not receive a fix; users on those versions should upgrade to 2.17.20 or later.
What to do
Upgrade to a fixed version: 2.17.20, 3.1.7, 3.2.2.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- Grafana Enterprise Metrics (GEM)
From 2.11.0 · through 2.16.2; From 2.17.0 · fixed in 2.17.20
- Grafana Grafana Mimir
From 3.0.4 · fixed in 3.1.7; From 3.2.0 · fixed in 3.2.2
Evidence 1
- Advisory
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.