Unprotected Prometheus Endpoints May Expose Sensitive Data

guest · Oct 18, 2021

Many Prometheus Endpoints Expose Sensitive Data
October 18, 2021
https://www.securityweek.com/many-prometheus-endpoints-expose-sensitive-data

Designed to harvest real-time metrics from various endpoints, Prometheus enables organizations to keep a close eye on systems’ state, network usage, and the like. Close to 800 cloud-native platforms, including Slack and Uber, leverage the solution.

In January 2021, Prometheus added support for Transport Layer Security (TLS) and basic authentication, to prevent access to the captured metrics. However, numerous Prometheus endpoints that are accessible from the Internet were found to leak metric and label data, JFrog reveals.
Click to expand...

JFrog performed “a large-scale unauthenticated scraping of publicly available and non-secured Prometheus endpoints,” which by default allow for untrusted, public access.

This means that most publicly-exposed Prometheus endpoints could be accessed from the Internet without authentication, and JFrog found nearly 27,000 of them using Shodan, and 43,000 hosts using ZoomEye.
Click to expand...

Non-secure deployments of Prometheus, JFrog warns, may pose an even larger security risk, via an optional management API that can be used to delete metrics and close the monitoring server. Roughly 15 percent of the identified exposed Prometheus endpoints had the API management feature enabled (it is disabled by default).

“This means that right off the bat, an unauthenticated attacker can trivially shutdown and/or delete the metrics of these Prometheus endpoints,” JFrog notes.
Basic authentication capabilities and TLS support were added in Prometheus version 2.24.0, and developers and organizations are advised to update to that or newer versions of the monitoring solution, to prevent sensitive data leaks.
Click to expand...

Log in or Sign up

Unprotected Prometheus Endpoints May Expose Sensitive Data

guest Guest

Log in or Sign up

Unprotected Prometheus Endpoints May Expose Sensitive Data

guest Guest

Useful Searches