Bug 2149436 (CVE-2022-46146) - CVE-2022-46146 exporter-toolkit: authentication bypass via cache poisoning
Summary: CVE-2022-46146 exporter-toolkit: authentication bypass via cache poisoning
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2022-46146
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2149437 2149438 2149439 2149440 2149531
Blocks: 2149305
TreeView+ depends on / blocked
 
Reported: 2022-11-29 21:52 UTC by Anten Skrabec
Modified: 2024-03-01 22:56 UTC (History)
21 users (show)

Fixed In Version: exporter-toolkit 0.7.2, exporter-toolkit 0.7.3, exporter-toolkit 0.8.2
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in exporter-toolkit. A request can be forged by an attacker to poison the internal cache used to cache hashes and make subsequent successful requests. This cache is used to limit side channel attacks that could tell an attacker if a user is present in the file or not. Prometheus and its exporters can be secured by a web.yml file that specifies usernames and hashed passwords for basic authentication. Passwords are hashed with bcrypt, which means that even if you have access to the hash, it is very hard to find the original password. However, due to the way this mechanism was implemented in the exporter toolkit, if the hashed password is known, it is possible to authenticate against Prometheus.
Clone Of:
Environment:
Last Closed: 2023-05-18 04:31:36 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2023:1326 0 None None None 2023-05-17 22:31:07 UTC
Red Hat Product Errata RHSA-2023:2110 0 None None None 2023-05-10 14:44:14 UTC
Red Hat Product Errata RHSA-2023:5001 0 None None None 2023-09-13 05:16:18 UTC

Description Anten Skrabec 2022-11-29 21:52:18 UTC 
Prometheus and its exporters can be secured by a web.yml file that specifies usernames and hashed passwords for basic authentication.

Passwords are hashed with bcrypt, which means that even if you have access to the hash, it is very hard to find the original password back.

However, a flaw in the way this mechanism was implemented in the exporter toolkit makes it possible with people who know the hashed password to authenticate against Prometheus.

A request can be forged by an attacker to poison the internal cache used to cache the computation of hashes and make subsequent requests successful. This cache is used in both happy and unhappy scenarios in order to limit side channel attacks that could tell an attacker if a user is present in the file or not.
Comment 1 Anten Skrabec 2022-11-29 21:52:41 UTC 
Created golang-github-prometheus tracking bugs for this issue:

Affects: epel-all [bug 2149437]


Created golang-github-prometheus-alertmanager tracking bugs for this issue:

Affects: epel-all [bug 2149439]


Created golang-github-prometheus-exporter-toolkit tracking bugs for this issue:

Affects: fedora-all [bug 2149440]


Created golang-github-prometheus-node-exporter tracking bugs for this issue:

Affects: epel-all [bug 2149438]
Comment 7 errata-xmlrpc 2023-05-10 14:44:12 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.12

Via RHSA-2023:2110 https://access.redhat.com/errata/RHSA-2023:2110
Comment 8 errata-xmlrpc 2023-05-17 22:31:06 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.13

Via RHSA-2023:1326 https://access.redhat.com/errata/RHSA-2023:1326
Comment 9 Product Security DevOps Team 2023-05-18 04:31:33 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-46146
Comment 12 errata-xmlrpc 2023-09-13 05:16:16 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.11

Via RHSA-2023:5001 https://access.redhat.com/errata/RHSA-2023:5001
Note You need to log in before you can comment on or make changes to this bug.