CVE-2023-40577

Alertmanager handles alerts sent by client applications such as the Prometheus server. An attacker with the permission to perform POST requests on the /api/v1/alerts endpoint could be able to execute arbitrary JavaScript code on the users of Prometheus Alertmanager. This issue has been fixed in Alertmanager version 0.2.51.

Impact

An attacker with the permission to perform POST requests on the /api/v1/alerts endpoint could be able to execute arbitrary JavaScript code on the users of Prometheus Alertmanager.

Patches

Users can upgrade to Alertmanager v0.2.51.

Workarounds

Users can setup a reverse proxy in front of the Alertmanager web server to forbid access to the /api/v1/alerts endpoint.

References

N/A

Alertmanager handles alerts sent by client applications such as the Prometheus server. An attacker with the permission to perform POST requests on the /api/v1/alerts endpoint could be able to execute arbitrary JavaScript code on the users of Prometheus Alertmanager. This issue has been fixed in Alertmanager version 0.2.51.

Alertmanager handles alerts sent by client applications such as the Prometheus server. An attacker with the permission to perform POST requests on the /api/v1/alerts endpoint could be able to execute arbitrary JavaScript code on the users of Prometheus Alertmanager. This issue has been fixed in Alertmanager version 0.2.51.

Alertmanager UI is vulnerable to stored XSS via the /api/v1/alerts endpoint in github.com/prometheus/alertmanager

These are all security issues fixed in the golang-github-prometheus-alertmanager-0.26.0-4.1 package on the GA media of openSUSE Tumbleweed.

This update fixes the following issues:

golang-github-QubitProducts-exporter_exporter:

• Exclude s390 arch
• Adapted to build on Enterprise Linux.
• Fix build for RedHat 7
• Require Go >= 1.14 also for CentOS
• Add support for CentOS
• Replace %{?systemd_requires} with %{?systemd_ordering}

golang-github-boynux-squid_exporter:

• Exclude s390 architecture (gh#SUSE/spacewalk#19050)
• Enhanced to build on Enterprise Linux 8.

golang-github-lusitaniae-apache_exporter:

• Do not strip if SUSE Linux Enterprise 15 SP3
• Exclude debug for RHEL >= 8
• Build with Go >= 1.20 when the OS is not RHEL
• Fix apparmor profile for SLE 12
• Upgrade to version 1.0.0 (jsc#PED-5405)
  • Improved flag parsing
  • Added support for custom headers
• Build using promu
• Fix sandboxing options
• Upgrade to version 0.13.4
  • CVE-2022-32149: Fix denial of service vulnerability (bsc#1204501)
• Upgrade to version 0.13.3
  • CVE-2022-41723: Fix uncontrolled resource consumption (bsc#1208270)
• Upgrade to version 0.13.1
  • Fix panic caused by missing flagConfig options
• Upgrade to version 0.13.0
  • CVE-2022-46146: Fix authentication bypass vulnarability (bsc#1208046)
• Corrected comment in AppArmor profile
• Added AppArmor profile
• Added sandboxing options to systemd service unit
• Exclude s390 architecture (gh#SUSE/spacewalk#19050)
• Update to upstream release 0.11.0 (jsc#SLE-24791)
  • Add TLS support
  • Switch to logger, please check --log.level and --log.format flags
• Update to version 0.10.1
  • Bugfix: Reset ProxyBalancer metrics on each scrape to remove stale data
• Update to version 0.10.0
  • Add Apache Proxy and other metrics
• Update to version 0.8.0
  • Change commandline flags
  • Add metrics: Apache version, request duration total
• Adapted to build on Enterprise Linux 8
• Require building with Go 1.15
• Add support for RedHat 8
  • Adjust dependencies on spec file
  • Disable dwarf compression in go build
• Add support for Red Hat
• Add %license macro for LICENSE file

golang-github-prometheus-alertmanager:

• Do not create PIE for s390x architecture
• Require Go 1.20 or newer for building
• Remove not used build flags
• Create position independent executables (PIE)
• Disable striping the binaries only for SLE 15 SP3
• Add System/Monitoring group tag
• Rework service file to use obscpio
  • Run tar and recompress services at buildtime
  • Do not generate automatically changelog entries
• Update to version 0.26.0 (jsc#PED-7353): https://github.com/prometheus/alertmanager/releases/tag/v0.26.0
  • CVE-2023-40577: Fix stored XSS via the /api/v1/alerts endpoint in the Alertmanager UI (bsc#1218838)
  • Configuration: Fix empty list of receivers and inhibit_rules would cause the alertmanager to crash
  • Templating: Fixed a race condition when using the title function. It is now race-safe
  • API: Fixed duplicate receiver names in the api/v2/receivers API endpoint
  • API: Attempting to delete a silence now returns the correct status code, 404 instead of 500
  • Clustering: Fixes a panic when tls_client_config is empty
  • Webhook: url is now marked as a secret. It will no longer show up in the logs as clear-text
  • Metrics: New label reason for alertmanager_notifications_failed_total metric to indicate the type of error of the alert delivery
  • Clustering: New flag --cluster.label, to help to block any traffic that is not meant for the cluster
  • Integrations: Add Microsoft Teams as a supported integration
• Update to version 0.25.0: https://github.com/prometheus/alertmanager/releases/tag/v0.25.0
  • Fail configuration loading if api_key and api_key_file are defined at the same time
  • Fix the alertmanager_alerts metric to avoid counting resolved alerts as active. Also added a new alertmanager_marked_alerts metric that retain the old behavior
  • Trim contents of Slack API URLs when reading from files
  • amtool: Avoid panic when the label value matcher is empty
  • Fail configuration…

This update fixes the following issues:

golang-github-lusitaniae-apache_exporter:

• Do not strip if SUSE Linux Enterprise 15 SP3
• Exclude debug for Red Hat Enterprise Linux >= 8
• Build with Go >= 1.20 when the OS is not Red Hat Enterprise Linux

golang-github-prometheus-alertmanager:

• Create position independent executables (PIE)
• Add System/Monitoring group tag
• Update to version 0.26.0 (jsc#PED-7353): https://github.com/prometheus/alertmanager/releases/tag/v0.26.0
  • CVE-2023-40577: Fix stored XSS via the /api/v1/alerts endpoint in the Alertmanager UI (bsc#1218838)
  • Configuration: Fix empty list of receivers and inhibit_rules would cause the alertmanager to crash
  • Templating: Fixed a race condition when using the title function. It is now race-safe
  • API: Fixed duplicate receiver names in the api/v2/receivers API endpoint
  • API: Attempting to delete a silence now returns the correct status code, 404 instead of 500
  • Clustering: Fixes a panic when tls_client_config is empty
  • Webhook: url is now marked as a secret. It will no longer show up in the logs as clear-text
  • Metrics: New label reason for alertmanager_notifications_failed_total metric to indicate the type of error of the alert delivery
  • Clustering: New flag --cluster.label, to help to block any traffic that is not meant for the cluster
  • Integrations: Add Microsoft Teams as a supported integration
• Update to version 0.25.0: https://github.com/prometheus/alertmanager/releases/tag/v0.25.0
  • Fail configuration loading if api_key and api_key_file are defined at the same time
  • Fix the alertmanager_alerts metric to avoid counting resolved alerts as active. Also added a new alertmanager_marked_alerts metric that retain the old behavior
  • Trim contents of Slack API URLs when reading from files
  • amtool: Avoid panic when the label value matcher is empty
  • Fail configuration loading if api_url is empty for OpsGenie
  • Fix email template for resolved notifications
  • Add proxy_url support for OAuth2 in HTTP client configuration
  • Reload TLS certificate and key from disk when updated
  • Add Discord integration
  • Add Webex integration
  • Add min_version support to select the minimum TLS version in HTTP client configuration
  • Add max_version support to select the maximum TLS version in
  • Emit warning logs when truncating messages in notifications
  • Support HEAD method for the /-/healty and /-/ready endpoints
  • Add support for reading global and local SMTP passwords from files
  • UI: Add 'Link' button to alerts in list
  • UI: Allow to choose the first day of the week as Sunday or Monday
• Update to version 0.24.0: https://github.com/prometheus/alertmanager/releases/tag/v0.24.0
  • Fix HTTP client configuration for the SNS receiver
  • Fix unclosed file descriptor after reading the silences snapshot file
  • Fix field names for mute_time_intervals in JSON marshaling
  • Ensure that the root route doesn't have any matchers
  • Truncate the message's title to 1024 chars to avoid hitting Slack limits
  • Fix the default HTML email template (email.default.html) to match with the canonical source
  • Detect SNS FIFO topic based on the rendered value
  • Avoid deleting and recreating a silence when an update is possible
  • api/v2: Return 200 OK when deleting an expired silence
  • amtool: Fix the silence's end date when adding a silence. The end date is (start date + duration) while it used to be (current time + duration). The new behavior is consistent with the update operation
  • Add the /api/v2 prefix to all endpoints in the OpenAPI specification and generated client code
  • Add --cluster.tls-config experimental flag to secure cluster traffic via mutual TLS
  • Add Telegram integration

mgr-daemon:

• Version 4.3.8-1
  • Update translation strings

prometheus-postgres_exporter:

• Remove duplicated call to systemd…

This update for golang-github-prometheus-alertmanager fixes the following issues:

golang-github-prometheus-alertmanager was updated from version 0.23.0 to 0.26.0 (jsc#PED-7353):

• Version 0.26.0:
  • Security fixes:
    • CVE-2023-40577: Fix stored XSS via the /api/v1/alerts endpoint in the Alertmanager UI (bsc#1218838)
  • Other changes and bugs fixed:
    • Configuration: Fix empty list of receivers and inhibit_rules would cause the alertmanager to crash
    • Templating: Fixed a race condition when using the title function. It is now race-safe
    • API: Fixed duplicate receiver names in the api/v2/receivers API endpoint
    • API: Attempting to delete a silence now returns the correct status code, 404 instead of 500
    • Clustering: Fixes a panic when tls_client_config is empty
    • Webhook: url is now marked as a secret. It will no longer show up in the logs as clear-text
    • Metrics: New label reason for alertmanager_notifications_failed_total metric to indicate the type of error of the alert delivery
    • Clustering: New flag --cluster.label, to help to block any traffic that is not meant for the cluster
    • Integrations: Add Microsoft Teams as a supported integration
• Version 0.25.0:
  • Fail configuration loading if api_key and api_key_file are defined at the same time
  • Fix the alertmanager_alerts metric to avoid counting resolved alerts as active. Also added a new alertmanager_marked_alerts metric that retain the old behavior
  • Trim contents of Slack API URLs when reading from files
  • amtool: Avoid panic when the label value matcher is empty
  • Fail configuration loading if api_url is empty for OpsGenie
  • Fix email template for resolved notifications
  • Add proxy_url support for OAuth2 in HTTP client configuration
  • Reload TLS certificate and key from disk when updated
  • Add Discord integration
  • Add Webex integration
  • Add min_version support to select the minimum TLS version in HTTP client configuration
  • Add max_version support to select the maximum TLS version in HTTP client configuration
  • Emit warning logs when truncating messages in notifications
  • Support HEAD method for the /-/healty and /-/ready endpoints
  • Add support for reading global and local SMTP passwords from files
  • UI: Add 'Link' button to alerts in list
  • UI: Allow to choose the first day of the week as Sunday or Monday
• Version 0.24.0:
  • Fix HTTP client configuration for the SNS receiver
  • Fix unclosed file descriptor after reading the silences snapshot file
  • Fix field names for mute_time_intervals in JSON marshaling
  • Ensure that the root route doesn't have any matchers
  • Truncate the message's title to 1024 chars to avoid hitting Slack limits
  • Fix the default HTML email template (email.default.html) to match with the canonical source
  • Detect SNS FIFO topic based on the rendered value
  • Avoid deleting and recreating a silence when an update is possible
  • api/v2: Return 200 OK when deleting an expired silence
  • amtool: Fix the silence's end date when adding a silence. The end date is (start date + duration) while it used to be (current time + duration). The new behavior is consistent with the update operation
  • Add the /api/v2 prefix to all endpoints in the OpenAPI specification and generated client code
  • Add --cluster.tls-config experimental flag to secure cluster traffic via mutual TLS
  • Add Telegram integration

It was discovered that prometheus-alertmanager didn't properly sanitize input it received through an API endpoint. An attacker with permission to send requests to this endpoint could potentially inject arbitrary code.

On Ubuntu 20.04 LTS and Ubuntu 22.04 LTS, this vulnerability is only present if the UI has been explicitly activated.