Percona Monitoring and Management Server up to 2.37.0 POST auth_server.go path traversal

Summaryinfo

A vulnerability described as critical has been identified in Percona Monitoring and Management Server up to 2.37.0. This issue affects some unknown processing of the file auth_server.go of the component POST Handler. Executing a manipulation can lead to path traversal. This vulnerability is tracked as CVE-2023-34409. The attack can be launched remotely. No exploit exists. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability has been found in Percona Monitoring and Management Server up to 2.37.0 and classified as critical. This vulnerability affects an unknown code block of the file auth_server.go of the component POST Handler. The manipulation with an unknown input leads to a path traversal vulnerability. The CWE definition for the vulnerability is CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

In Percona Monitoring and Management (PMM) server 2.x before 2.37.1, the authenticate function in auth_server.go does not properly formalize and sanitize URL paths to reject path traversal attempts. This allows an unauthenticated remote user, when a crafted POST request is made against unauthenticated API routes, to access otherwise protected API routes leading to escalation of privileges and information disclosure.

The weakness was disclosed 06/06/2023. The advisory is shared for download at percona.com. This vulnerability was named CVE-2023-34409 since 06/05/2023. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1006.

Upgrading to version 2.37.1 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2023-38487). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• Percona

Name

• Monitoring and Management Server

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5
• 2.6
• 2.7
• 2.8
• 2.9
• 2.10
• 2.11
• 2.12
• 2.13
• 2.14
• 2.15
• 2.16
• 2.17
• 2.18
• 2.19
• 2.20
• 2.21
• 2.22
• 2.23
• 2.24
• 2.25
• 2.26
• 2.27
• 2.28
• 2.29
• 2.30
• 2.31
• 2.32
• 2.33
• 2.34
• 2.35
• 2.36
• 2.37.0

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion