GHSA-jphm-g89m-v42p
Path traversal in Grafana Cortex
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | github.com/cortexproject/cortex | <= 1.9.0 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
An issue was discovered in Grafana Cortex through 1.9.0. The header value X-Scope-OrgID is used to construct file paths for rules files, and if crafted to conduct directory traversal such as ae ../../sensitive/path/in/deployment pathname, then Cortex will attempt to parse a rules file at that location and include some of the contents in the error message. (Other Cortex API requests can also be sent a malicious OrgID header, e.g., tricking the ingester into writing metrics to a different location, but the effect is nuisance rather than information disclosure.)
References
External links from the advisory. They lead to third-party sites.