Synthetic Monitoring Agent up to 0.11.x on Grafana debug code

Summaryinfo

A vulnerability described as critical has been identified in Synthetic Monitoring Agent up to 0.11.x on Grafana. This affects an unknown function. Executing a manipulation can lead to debug code. This vulnerability appears as CVE-2022-46156. The attack may be performed from remote. There is no available exploit. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability has been found in Synthetic Monitoring Agent up to 0.11.x on Grafana and classified as critical. This vulnerability affects an unknown code block. The manipulation with an unknown input leads to a debug code vulnerability. The CWE definition for the vulnerability is CWE-489. The product is deployed to unauthorized actors with debugging code still enabled or active, which can create unintended entry points or expose sensitive information. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

The Synthetic Monitoring Agent for Grafana's Synthetic Monitoring application provides probe functionality and executes network checks for monitoring remote targets. Users running the Synthetic Monitoring agent prior to version 0.12.0 in their local network are impacted. The authentication token used to communicate with the Synthetic Monitoring API is exposed through a debugging endpoint. This token can be used to retrieve the Synthetic Monitoring checks created by the user and assigned to the agent identified with that token. The Synthetic Monitoring API will reject connections from already-connected agents, so access to the token does not guarantee access to the checks. Version 0.12.0 contains a fix. Users are advised to rotate the agent tokens. After upgrading to version v0.12.0 or later, it's recommended that users of distribution packages review the configuration stored in `/etc/synthetic-monitoring/synthetic-monitoring-agent.conf`, specifically the `API_TOKEN` variable which has been renamed to `SM_AGENT_API_TOKEN`. As a workaround for previous versions, it's recommended that users review the agent settings and set the HTTP listening address in a manner that limits the exposure, for example, localhost or a non-routed network, by using the command line parameter `-listen-address`, e.g. `-listen-address localhost:4050`.

The weakness was presented 12/01/2022 as GHSA-9j4f-f249-q5w8. The advisory is available at github.com. This vulnerability was named CVE-2022-46156 since 11/28/2022. The technical details are unknown and an exploit is not available.

Upgrading to version 0.12.0 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch d8dc7f9c1c641881cbcf0a09e178b90ebf0f0228 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2024-2762). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• Synthetic Monitoring Agent

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9
• 0.10
• 0.11

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion