CVE-2023-40577: Alertmanager UI is vulnerable to stored XSS via the /api/v1/alerts endpoint
Impact
An attacker with the permission to perform POST requests on the /api/v1/alerts endpoint could be able to execute arbitrary JavaScript code on the users of Prometheus Alertmanager.
Patches
Users can upgrade to Alertmanager v0.2.51.
Workarounds
Users can setup a reverse proxy in front of the Alertmanager web server to forbid access to the /api/v1/alerts endpoint.
References
N/A
Other sources
Alertmanager handles alerts sent by client applications such as the Prometheus server. An attacker with the permission to perform POST requests on the /api/v1/alerts endpoint could be able to execute arbitrary JavaScript code on the users of Prometheus Alertmanager. This issue has been fixed in Alertmanager version 0.2.51.
— Ubuntu
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/prometheus/alertmanagerto a version that resolves this vulnerability.Fixed in 0.25.1 - Upgrade
Upgrade
debian/prometheus-alertmanagerto a version that resolves this vulnerability.Fixed in 0.27.0+ds-2 - Upgrade
Upgrade
ubuntu/prometheus-alertmanagerto a version that resolves this vulnerability.Fixed in 0.6.2+ - Upgrade
Upgrade
ubuntu/prometheus-alertmanagerto a version that resolves this vulnerability.Fixed in 0.15.3+ - Upgrade
Upgrade
ubuntu/prometheus-alertmanagerto a version that resolves this vulnerability.Fixed in 0.23.0-4ubuntu0.2+ - Upgrade
Upgrade
ubuntu/prometheus-alertmanagerto a version that resolves this vulnerability.Fixed in 0.26.0+ - Upgrade
Upgrade
redhat/Alertmanagerto a version that resolves this vulnerability.Fixed in 0.25.1 - Upgrade
Upgrade
alpine/alertmanagerto a version that resolves this vulnerability.Fixed in 0.26.0-r0 - Upgrade
Upgrade
Alertmanagerto a version that resolves this vulnerability.Fixed in 0.2.51 - Compensating control
Set up a reverse proxy in front of the Alertmanager web server to forbid access to the /api/v1/alerts endpoint
Event History
Frequently Asked Questions
What is the severity of CVE-2023-40577?
CVE-2023-40577 is considered a high severity vulnerability due to its potential for arbitrary JavaScript code execution.
How do I fix CVE-2023-40577?
To fix CVE-2023-40577, users should upgrade to Alertmanager version 0.25.1 or later.
What software is affected by CVE-2023-40577?
CVE-2023-40577 affects Prometheus Alertmanager versions up to and including 0.25.0.
Can I mitigate CVE-2023-40577 without upgrading?
Yes, users can implement workarounds such as restricting access to the /api/v1/alerts endpoint to limit exposure.
What type of attack does CVE-2023-40577 facilitate?
CVE-2023-40577 allows attackers to execute malicious JavaScript in the context of user sessions.