// For flags

CVE-2021-36157

cortex: Grafana Cortex directory traversal

Severity Score

5.3
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

An issue was discovered in Grafana Cortex through 1.9.0. The header value X-Scope-OrgID is used to construct file paths for rules files, and if crafted to conduct directory traversal such as ae ../../sensitive/path/in/deployment pathname, then Cortex will attempt to parse a rules file at that location and include some of the contents in the error message. (Other Cortex API requests can also be sent a malicious OrgID header, e.g., tricking the ingester into writing metrics to a different location, but the effect is nuisance rather than information disclosure.)

Se ha detectado un problema en Grafana Cortex versiones hasta 1.9.0. El valor del encabezado X-Scope-OrgID es usado para diseñar rutas de archivos para los archivos de reglas, y si se diseña para realizar un salto de directorio tal y como ae ../../sensitive/path/in/deployment pathname, Cortex intentará analizar un archivo de reglas en esa ubicación e incluirá parte del contenido en el mensaje de error. (Otras peticiones de la API de Cortex también pueden ser enviados un encabezado OrgID malicioso, por ejemplo, engañando al ingester para que escriba las métricas en una ubicación diferente, pero el efecto es de molestia más que de revelación de información)

A flaw in the Grafana cortex package could allow a remote attacker to traverse directories on the system caused by improper input validation by the X-Scope-OrgID header value. An attacker could send a specially-crafted URL request containing "dot-dot" sequences (/../) to view some of the contents in the error message.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2021-07-05 CVE Reserved
  • 2021-08-03 CVE Published
  • 2024-04-18 EPSS Updated
  • 2024-08-04 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Linuxfoundation
Search vendor "Linuxfoundation"
 Cortex
Search vendor "Linuxfoundation" for product "Cortex"
 <= 1.9.0
Search vendor "Linuxfoundation" for product "Cortex" and version " <= 1.9.0"
-
Affected