CVE-2021-36156 Path traversal in Grafana Loki
Attackers can read sensitive files via directory traversal in Grafana Loki by manipulating the X-Scope-OrgID header, leading to information disclosure.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-36156?
CVE-2021-36156 is a medium-severity path traversal vulnerability in n/a, published on 3 Aug 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in Grafana Loki through 2.2.1. The header value X-Scope-OrgID is used to construct file paths for rules files, and if crafted to conduct directory traversal such as ae ../../sensitive/path/in/deployment pathname, then Loki will attempt to parse a rules file at that location and include some of the contents in the error message.
Weakness: CWE-22
Which versions are affected by CVE-2021-36156?
2 open source packages ship an affected version, including github.com/grafana/loki. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/grafana/loki Go | All versions | 2.3.0 |
github.com/grafana/loki Go | All versions | 2.3.0 |
Products include Grafana Loki.
How do I fix CVE-2021-36156?
Upgrade github.com/grafana/loki to 2.3.0 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2021-36156 being exploited?
There is no known exploitation of CVE-2021-36156 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-grj5-8x6q-hc9q.