Bug 2183161 (CVE-2021-36156) - CVE-2021-36156 loki: Path traversal in Grafana Loki
Summary: CVE-2021-36156 loki: Path traversal in Grafana Loki
Keywords:
Status: NEW
Alias: CVE-2021-36156
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Nobody
QA Contact:
URL:
Whiteboard:
Depends On: 2183163 2183165 2183176
Blocks: 2180566
TreeView+ depends on / blocked
 
Reported: 2023-03-30 13:22 UTC by Avinash Hanwate
Modified: 2024-03-02 05:32 UTC (History)
18 users (show)

Fixed In Version: Grafana loki 2.3.0
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in Grafana Loki that could allow a remote attacker to traverse directories on the system, caused by improper input validation by the X-Scope-OrgID header value. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view some of the contents in the error message.
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description Avinash Hanwate 2023-03-30 13:22:27 UTC 
An issue was discovered in Grafana Loki through 2.2.1. The header value X-Scope-OrgID is used to construct file paths for rules files, and if crafted to conduct directory traversal such as ae ../../sensitive/path/in/deployment pathname, then Loki will attempt to parse a rules file at that location and include some of the contents in the error message.

https://github.com/grafana/loki/pull/4020#issue-694377133
https://github.com/grafana/loki/releases/tag/v2.3.0
Comment 1 Avinash Hanwate 2023-03-30 13:27:21 UTC 
Created grafana tracking bugs for this issue:

Affects: fedora-all [bug 2183163]
Note You need to log in before you can comment on or make changes to this bug.