CVE-2021-41090 log
| Source |
|
| Severity | High |
| Remote | Yes |
| Type | Information disclosure |
| Description | A security issue has been found in Grafana Agent before version 0.21.2. Some inline secrets are exposed in plaintext over the Grafana Agent HTTP server:
- Inline secrets for metrics instance configs in the base YAML file are exposed at /-/config
- Inline secrets for integrations are exposed at /-/config
- Inline secrets for Consul ACL tokens and ETCD basic auth when configured for the scraping service at /-/config.
- Inline secrets for the Kafka receiver for OpenTelemetry-Collector tracing at /-/config.
- Inline secrets for metrics instance configs loaded from the scraping service are exposed at /agent/api/v1/configs/{name}.
Inline secrets will be exposed to anyone being able to reach these endpoints.
Secrets found in these sections are used for:
- Delivering metrics to a Prometheus Remote Write system
- Authenticating against a system for discovering Prometheus targets
- Authenticating against a system for collecting metrics (scrape_configs and integrations)
- Authenticating against a Consul or ETCD for storing configurations to distribute in scraping service mode
- Authenticating against Kafka for receiving traces
Non-inlined secrets, such as *_file-based secrets, are not impacted by this vulnerability. |
| Group | Package | Affected | Fixed | Severity | Status | Ticket |
|---|---|---|---|---|---|---|
| AVG-2614 | grafana-agent | 0.21.0-1 | 0.21.2-1 | High | Fixed |
| Date | Advisory | Group | Package | Severity | Type |
|---|---|---|---|---|---|
| 11 Dec 2021 | ASA-202112-12 | AVG-2614 | grafana-agent | High | information disclosure |
| References |
|---|
https://github.com/grafana/agent/security/advisories/GHSA-9c4x-5hgq-q3wh |
| Notes |
|---|
Workaround ========== To mitigate the issue, use non-inline secrets where possible. Not all configuration options may have a non-inline equivalent. You also may desire to restrict API access to Grafana Agent, with some combination of: - Restrict network interfaces Grafana Agent listens on through http_listen_address in the server block. 127.0.0.1 is the most restrictive, 0.0.0.0 is the default. - Configure Grafana Agent to use HTTPS with client authentication. - Use firewall rules to restrict external access to Grafana Agent's API. |