Enterprise Metrics Gem
Monthly
Authenticated tenants who can write their Alertmanager configuration in Grafana Mimir or Grafana Enterprise Metrics (GEM) can read arbitrary files from the Alertmanager host and exfiltrate them to a server they control. The receiver validation that rejects local file references missed two HTTP client settings, http_headers.<name>.files and basic_auth.username_file, so a tenant can point them at any file the Alertmanager process can read; the contents are then placed in an outgoing request header when a notification fires. The issue is rated 7.7 High (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) with confidentiality-only impact, is fixed in Mimir 3.1.7 and 3.2.2 and in GEM 2.17.20, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Authenticated tenants who can write their Alertmanager configuration in Grafana Mimir or Grafana Enterprise Metrics (GEM) can read arbitrary files from the Alertmanager host and exfiltrate them to a server they control. The receiver validation that rejects local file references missed two HTTP client settings, http_headers.<name>.files and basic_auth.username_file, so a tenant can point them at any file the Alertmanager process can read; the contents are then placed in an outgoing request header when a notification fires. The issue is rated 7.7 High (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) with confidentiality-only impact, is fixed in Mimir 3.1.7 and 3.2.2 and in GEM 2.17.20, and no public exploit code or confirmed active exploitation was identified at time of analysis.