CVE-2023-40577: Alertmanager UI is vulnerable to stored XSS via the /api/v1/alerts endpoint
Impact
An attacker with the permission to perform POST requests on the /api/v1/alerts endpoint could be able to execute arbitrary JavaScript code on the users of Prometheus Alertmanager.
Patches
Users can upgrade to Alertmanager v0.2.51.
Workarounds
Users can setup a reverse proxy in front of the Alertmanager web server to forbid access to the /api/v1/alerts endpoint.
References
N/A
Other sources
Alertmanager handles alerts sent by client applications such as the Prometheus server. An attacker with the permission to perform POST requests on the /api/v1/alerts endpoint could be able to execute arbitrary JavaScript code on the users of Prometheus Alertmanager. This issue has been fixed in Alertmanager version 0.2.51.
— Ubuntu
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-40577?
CVE-2023-40577 is considered a high severity vulnerability due to its potential for arbitrary JavaScript code execution.
How do I fix CVE-2023-40577?
To fix CVE-2023-40577, users should upgrade to Alertmanager version 0.25.1 or later.
What software is affected by CVE-2023-40577?
CVE-2023-40577 affects Prometheus Alertmanager versions up to and including 0.25.0.
Can I mitigate CVE-2023-40577 without upgrading?
Yes, users can implement workarounds such as restricting access to the /api/v1/alerts endpoint to limit exposure.
What type of attack does CVE-2023-40577 facilitate?
CVE-2023-40577 allows attackers to execute malicious JavaScript in the context of user sessions.