GHSA-4v48-4q5m-8vx4 Prometheus vulnerable to basic authentication bypass

Not scored Published 5 Dec 2022

An attacker with access to hashed passwords can bypass basic authentication in Prometheus by poisoning the internal hash cache.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is GHSA-4v48-4q5m-8vx4?

GHSA-4v48-4q5m-8vx4 is an authentication bypass vulnerability in github.com/prometheus/prometheus, published on 5 Dec 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Impact

Prometheus can be secured by a web.yml file that specifies usernames and hashed passwords for basic authentication.

Passwords are hashed with bcrypt, which means that even if you have access to the hash, it is very hard to find the original password back.

However, a flaw in the way this mechanism was implemented in the exporter toolkit makes it possible with people who know the hashed password to authenticate against Prometheus.

A request can be forged by an attacker to poison the internal cache used to cache the computation of hashes and make subsequent requests successful. This cache is used in both happy and unhappy scenarios in order to limit side channel attacks that could tell an attacker if a user is present in the file or not.

Patches

Prometheus 2.37.4 (LTS) and 2.40.4 have been released to address this issue.

Workarounds

There is no workaround but attacker must have access to the hashed password, stored in disk, to bypass the authentication.

Credit

We want to thank Lei Wan for reporting this security issue.

Which versions are affected by GHSA-4v48-4q5m-8vx4?

8 open source packages ship an affected version, including github.com/prometheus/prometheus and github.com/prometheus/prometheus/v2.

Package	Affected	Fixed in
`github.com/prometheus/prometheus` Go	From `2.24.1`	`2.37.4`
`github.com/prometheus/prometheus` Go	From `2.24.1`	`2.37.4`
`github.com/prometheus/prometheus` Go	From `2.38.0`	`2.40.4`
`github.com/prometheus/prometheus` Go	From `2.38.0`	`2.40.4`
`github.com/prometheus/prometheus/v2` Go	From `2.24.1`	`2.37.4`
`github.com/prometheus/prometheus/v2` Go	From `2.24.1`	`2.37.4`

2 more packages

`github.com/prometheus/prometheus/v2` Go	From `2.38.0`	`2.40.4`
`github.com/prometheus/prometheus/v2` Go	From `2.38.0`	`2.40.4`

How do I fix GHSA-4v48-4q5m-8vx4?

Upgrade github.com/prometheus/prometheus to a fixed version for your release line: 2.37.4 or 2.40.4.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is GHSA-4v48-4q5m-8vx4 being exploited?

There is no known exploitation of GHSA-4v48-4q5m-8vx4 in the wild and no public exploit code.