Bug 2149436 (CVE-2022-46146)

Summary:	CVE-2022-46146 exporter-toolkit: authentication bypass via cache poisoning
Product:	[Other] Security Response	Reporter:	Anten Skrabec <askrabec>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	agerstmayr, aoconnor, bdettelb, gparvin, grafana-maint, jburrell, jcantril, jkurik, kshier, mwringe, nathans, njean, owatkins, pahickey, periklis, rbobbitt, scox, stcannon, teagle, vkumar, yguenane
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	exporter-toolkit 0.7.2, exporter-toolkit 0.7.3, exporter-toolkit 0.8.2	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in exporter-toolkit. A request can be forged by an attacker to poison the internal cache used to cache hashes and make subsequent successful requests. This cache is used to limit side channel attacks that could tell an attacker if a user is present in the file or not. Prometheus and its exporters can be secured by a web.yml file that specifies usernames and hashed passwords for basic authentication. Passwords are hashed with bcrypt, which means that even if you have access to the hash, it is very hard to find the original password. However, due to the way this mechanism was implemented in the exporter toolkit, if the hashed password is known, it is possible to authenticate against Prometheus.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2023-05-18 04:31:36 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2149437, 2149439, 2149438, 2149440, 2149531
Bug Blocks:	2149305

Description Anten Skrabec 2022-11-29 21:52:18 UTC

Prometheus and its exporters can be secured by a web.yml file that specifies usernames and hashed passwords for basic authentication.

Passwords are hashed with bcrypt, which means that even if you have access to the hash, it is very hard to find the original password back.

However, a flaw in the way this mechanism was implemented in the exporter toolkit makes it possible with people who know the hashed password to authenticate against Prometheus.

A request can be forged by an attacker to poison the internal cache used to cache the computation of hashes and make subsequent requests successful. This cache is used in both happy and unhappy scenarios in order to limit side channel attacks that could tell an attacker if a user is present in the file or not.

Comment 1 Anten Skrabec 2022-11-29 21:52:41 UTC

Created golang-github-prometheus tracking bugs for this issue:

Affects: epel-all [bug 2149437]


Created golang-github-prometheus-alertmanager tracking bugs for this issue:

Affects: epel-all [bug 2149439]


Created golang-github-prometheus-exporter-toolkit tracking bugs for this issue:

Affects: fedora-all [bug 2149440]


Created golang-github-prometheus-node-exporter tracking bugs for this issue:

Affects: epel-all [bug 2149438]

Comment 7 errata-xmlrpc 2023-05-10 14:44:12 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.12

Via RHSA-2023:2110 https://access.redhat.com/errata/RHSA-2023:2110

Comment 8 errata-xmlrpc 2023-05-17 22:31:06 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.13

Via RHSA-2023:1326 https://access.redhat.com/errata/RHSA-2023:1326

Comment 9 Product Security DevOps Team 2023-05-18 04:31:33 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-46146

Comment 12 errata-xmlrpc 2023-09-13 05:16:16 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.11

Via RHSA-2023:5001 https://access.redhat.com/errata/RHSA-2023:5001