{"answers":{"affected":"8 open source packages ship an affected version, including github.com/prometheus/prometheus and github.com/prometheus/prometheus/v2.","exploited":"There is no known exploitation of GHSA-4v48-4q5m-8vx4 in the wild and no public exploit code.","fix":"Upgrade github.com/prometheus/prometheus to a fixed version for your release line: 2.37.4 or 2.40.4.","what":"GHSA-4v48-4q5m-8vx4 is an authentication bypass vulnerability in github.com/prometheus/prometheus, published on 5 Dec 2022. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for GHSA-4v48-4q5m-8vx4 and fix it if it is affected.\n\nWhat it is: GHSA-4v48-4q5m-8vx4 is an authentication bypass vulnerability in github.com/prometheus/prometheus, published on 5 Dec 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of GHSA-4v48-4q5m-8vx4 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- github.com/prometheus/prometheus (Go): affected from 2.24.1; fixed in 2.37.4\n- github.com/prometheus/prometheus (Go): affected from 2.24.1; fixed in 2.37.4\n- github.com/prometheus/prometheus (Go): affected from 2.38.0; fixed in 2.40.4\n- github.com/prometheus/prometheus (Go): affected from 2.38.0; fixed in 2.40.4\n- github.com/prometheus/prometheus/v2 (Go): affected from 2.24.1; fixed in 2.37.4\n- github.com/prometheus/prometheus/v2 (Go): affected from 2.24.1; fixed in 2.37.4\n- github.com/prometheus/prometheus/v2 (Go): affected from 2.38.0; fixed in 2.40.4\n- github.com/prometheus/prometheus/v2 (Go): affected from 2.38.0; fixed in 2.40.4\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-4v48-4q5m-8vx4/ (Markdown: https://insights.sbomify.com/GHSA-4v48-4q5m-8vx4/index.md)","id":"GHSA-4v48-4q5m-8vx4","markdown":"https://insights.sbomify.com/GHSA-4v48-4q5m-8vx4/index.md","name":"GHSA-4v48-4q5m-8vx4","record":{"aliases":[],"analysis":{"component_type":"server_software","fix_type":"upgrade","impacts":["security_bypass"],"network_reachable":"yes","non_default_config":true,"product_category":"Prometheus monitoring server","requires_auth":"none","summary":"An attacker with access to hashed passwords can bypass basic authentication in Prometheus by poisoning the internal hash cache.","user_interaction":"not_required","vuln_class":"auth_bypass"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"### Impact\n\nPrometheus can be secured by a web.yml file that specifies usernames and hashed passwords for basic authentication.\n\nPasswords are hashed with bcrypt, which means that even if you have access to the hash, it is very hard to find the original password back.\n\nHowever, a flaw in the way this mechanism was implemented in the [exporter toolkit](https://github.com/prometheus/exporter-toolkit) makes it possible with people who know the hashed password to authenticate against Prometheus.\n\nA request can be forged by an attacker to poison the internal cache used to cache the computation of hashes and make subsequent requests successful. This cache is used in both happy and unhappy scenarios in order to limit side channel attacks that could tell an attacker if a user is present in the file or not.\n\n### Patches\n\nPrometheus 2.37.4 ([LTS](https://prometheus.io/docs/introduction/release-cycle/)) and 2.40.4 have been released to address this issue.\n\n### Workarounds\n\nThere is no workaround but attacker must have access to the hashed password, stored in disk, to bypass the authentication.\n\n### Credit\n\nWe want to thank Lei Wan for reporting this security issue.","ecosystems":["Go"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"Prometheus vulnerable to basic authentication bypass","id":"GHSA-4v48-4q5m-8vx4","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"Go","product":null,"products":[],"type":"auth_bypass","year":"2022"},"n_packages":8,"n_references":null,"packages":[{"ecosystem":"Go","fixed":["2.37.4"],"introduced":["2.24.1"],"last_affected":[],"package":"github.com/prometheus/prometheus","purl":null,"source":"GHSA-4v48-4q5m-8vx4"},{"ecosystem":"Go","fixed":["2.37.4"],"introduced":["2.24.1"],"last_affected":[],"package":"github.com/prometheus/prometheus","purl":"pkg:golang/github.com/prometheus/prometheus","source":"GHSA-4v48-4q5m-8vx4"},{"ecosystem":"Go","fixed":["2.40.4"],"introduced":["2.38.0"],"last_affected":[],"package":"github.com/prometheus/prometheus","purl":null,"source":"GHSA-4v48-4q5m-8vx4"},{"ecosystem":"Go","fixed":["2.40.4"],"introduced":["2.38.0"],"last_affected":[],"package":"github.com/prometheus/prometheus","purl":"pkg:golang/github.com/prometheus/prometheus","source":"GHSA-4v48-4q5m-8vx4"},{"ecosystem":"Go","fixed":["2.37.4"],"introduced":["2.24.1"],"last_affected":[],"package":"github.com/prometheus/prometheus/v2","purl":null,"source":"GHSA-4v48-4q5m-8vx4"},{"ecosystem":"Go","fixed":["2.37.4"],"introduced":["2.24.1"],"last_affected":[],"package":"github.com/prometheus/prometheus/v2","purl":"pkg:golang/github.com/prometheus/prometheus/v2","source":"GHSA-4v48-4q5m-8vx4"},{"ecosystem":"Go","fixed":["2.40.4"],"introduced":["2.38.0"],"last_affected":[],"package":"github.com/prometheus/prometheus/v2","purl":null,"source":"GHSA-4v48-4q5m-8vx4"},{"ecosystem":"Go","fixed":["2.40.4"],"introduced":["2.38.0"],"last_affected":[],"package":"github.com/prometheus/prometheus/v2","purl":"pkg:golang/github.com/prometheus/prometheus/v2","source":"GHSA-4v48-4q5m-8vx4"}],"products":null,"published":"2022-12-05","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"An attacker with access to hashed passwords can bypass basic authentication in Prometheus by poisoning the internal hash cache.","url":"https://insights.sbomify.com/GHSA-4v48-4q5m-8vx4/"}