CVE-2022-23536 Alertmanager can expose local files content via specially crafted config

What is CVE-2022-23536?

CVE-2022-23536 is a medium-severity path traversal vulnerability in cortexproject cortex, published on 19 Dec 2022. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Cortex provides multi-tenant, long term storage for Prometheus. A local file inclusion vulnerability exists in Cortex versions 1.13.0, 1.13.1 and 1.14.0, where a malicious actor could remotely read local files as a result of parsing maliciously crafted Alertmanager configurations when submitted to the Alertmanager Set Configuration API. Only users of the Alertmanager service where `-experimental.alertmanager.enable-api` or `enable_api: true` is configured are affected. Affected Cortex users are advised to upgrade to patched versions 1.13.2 or 1.14.1. However as a workaround, Cortex administrators may reject Alertmanager configurations containing the `api_key_file` setting in the `opsgenie_configs` section before sending to the Set Alertmanager Configuration API.

Weakness: CWE-73, CWE-641, CWE-184

Which versions are affected by CVE-2022-23536?

5 open source packages ship an affected version, including github.com/cortexproject/cortex. It affects 1 product.

Products include Linuxfoundation Cortex.

How do I fix CVE-2022-23536?

Upgrade github.com/cortexproject/cortex to a fixed version for your release line: 1.13.2 or 1.14.1.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2022-23536 being exploited?

There is no known exploitation of CVE-2022-23536 in the wild and no public exploit code.

Other vulnerabilities in cortexproject cortex

• CVE-2021-31232 Improper input validation in CNCF Cortex Medium 5.5
• CVE-2021-36157 Path traversal in Grafana Cortex Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-cq2g-pw6q-hf7j, GO-2022-1175.