GHSA-grj5-8x6q-hc9q

ghsaUSosv

Path traversal in Grafana Loki

view advisory published 2021-09-02Licence: CC-BY-4.0

An issue was discovered in Grafana Loki through 2.2.1. The header value X-Scope-OrgID is used to construct file paths for rules files, and if crafted to conduct directory traversal such as ae ../../sensitive/path/in/deployment pathname, then Loki will attempt to parse a rules file at that location and include some of the contents in the error message.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2021-36156US	medium5.3	1.48% (74th)	—	2021-08-03
An issue was discovered in Grafana Loki through 2.2.1. The header value X-Scope-OrgID is used to construct file paths for rules files, and if crafted to conduct directory traversal…

references

External citations — patches, advisories, analysis.

https://github.com/grafana/lokiPACKAGE
https://github.com/grafana/loki/pull/4020WEB
https://github.com/grafana/loki/pull/4020#issue-694377133WEB
https://github.com/grafana/loki/releases/tag/v2.3.0WEB
https://nvd.nist.gov/vuln/detail/CVE-2021-36156ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan