Summary
Affected versions of Prometheus are vulnerable to DOM XSS. An attacker could exploit this by convincing an authenticated user to visit a crafted URL on a Prometheus server, allowing for the execution and persistent storage of arbitrary scripts.
Product
Prometheus before version 2.7.1.
Impact
An attacker could run arbitrary Javascript code on a victim. Since this value is stored in LocalStorage, it will persist in the DOM even if the user browses away from the page with the malformed URL, or even if they close and re-open the browser.
Steps to reproduce
- Have
enable-query-historyis set to true - Navigate to
http://server:9090/graph?g0.range_input=1h&g0.expr=prometheus_target_interval_length_seconds{instance%3D%22localhost%3A9090%22%2Cinterval%3D%2215s%22%2Cjob%3D%22%3Cscript%3Ealert(%27XSS%27)%3C%2Fscript%3E%22%2Cquantile%3D%220.01%22} - Try to type anything that might invoke the history
Expected result:
Alert with XSS message will pop up.
Remediation
Updated the Prometheus to 2.7.1 or above.
Credit
This issue was discovered and reported by Checkmarx Security Researcher Dor Tumarkin.
