Hacking

Prometheus endpoint unprotected installs could expose sensitive data

Experts discovered several unprotected installs of open source event monitoring solution Prometheus that may expose sensitive data.

JFrog researchers have discovered multiple unprotected instances of open source event monitoring solution Prometheus that may leak sensitive data.

The solution scrapes real-time metrics from multiple endpoints, it is used by several major organizations such as Uber.

Prometheus’ retrieval job, also called the scraper, pulls data from target services, aggregates it, and passes it to the database.

JFrog researchers discovered numerous Prometheus endpoints exposed online that leak metric and label data, they were able to perform “a large-scale unauthenticated scraping of publicly available and non-secured” installs.

In January, the Transport Layer Security (TLS) and basic authentication support was introduced with the release of version 2.24.0,

Unfortunately, many Prometheus installs haven’t yet enabled these security features and JFrog researchers have focused their analysis on them. JFrog performed “a large-scale unauthenticated scraping of publicly available and non-secured Prometheus endpoints.

JFrog found nearly 27,000 unsecured installs using the Shodan search engine, and 43,000 hosts using ZoomEye.

“Using search engines like Shodan or ZoomEye it’s extremely easy to find tens of thousands of Prometheus endpoints. The most effective single query we’ve seen in Shodan, was to look for Prometheus endpoints by the Web UI’s favicon .” reads the post published by the experts. “This specific query (http.favicon.hash:-1399433489) returns almost 27K hosts in Shodan and 43K hosts in ZoomEye. By iterating automatically over these exposed endpoints, we’ve seen that 100% of the endpoints returned from this query had publicly-accessible data (meaning no authentication mechanisms were in place).”

Exposed data could be sensitive and could be used by threat actors to carry out further attacks against the organizations. Exposed data

Some of the exposed data login credentials in URL strings related to multiple services, infrastructure services, machine addresses and metadata labels, SSH public keys, environment variables for Kubelet, and more.

JFrog experts also warned of further security risks,associated with an optional management API that can be enabled via command line flags and that can be abused to delete all the saved metrics and to shut down the monitoring server.

“In our unauthenticated scraping effort, we discovered that ~15% of the exposed Prometheus endpoints had enabled API management, and ~4% had enabled database management. This means that right off the bat, an unauthenticated attacker can trivially shutdown and/or delete the metrics of these Prometheus endpoints. While our investigation clearly indicates this capability, to avoid harm or damage to users of those endpoints, we did not make any attempt to cause such a shutdown or a deletion as part of this research.” continues the post.

Before JFrog published the report I was alerted about the exposed install by the security researchers Anis Haboubi.

Researchers recommend using authentication and encryption mechanisms when deploying Prometheus to prevent the leak of sensitive information.

Follow me on Twitter: @securityaffairs and Facebook

[adrotate banner=”9″][adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – hacking, Prometheus)

[adrotate banner=”5″]

[adrotate banner=”13″]

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.

Recent Posts

A ransomware attack disrupted services at Pittsburgh Regional Transit

A ransomware attack on Pittsburgh Regional Transit (PRT) was the root cause of the agency's…

1 hour ago

A cyber attack hit Japan Airlines delaying ticket sales for flights

A cyberattack hit Japan Airlines (JAL), causing the suspension of ticket sales for flights departing…

5 hours ago

Apache fixed a critical SQL Injection in Apache Traffic Control

Apache Software Foundation (ASF) addressed a critical SQL Injection vulnerability, tracked as CVE-2024-45387, in Apache Traffic…

15 hours ago

BellaCPP, Charming Kitten’s BellaCiao variant written in C++

Iran-linked APT group Charming Kitten has been observed using a new variant of the BellaCiao…

18 hours ago

DMM Bitcoin $308M Bitcoin heist linked to North Korea

Japanese and U.S. authorities attributed the theft of $308 million cryptocurrency from DMM Bitcoin to…

1 day ago

Adobe is aware that ColdFusion bug CVE-2024-53961 has a known PoC exploit code

Adobe released out-of-band security updates to address a critical ColdFusion vulnerability, experts warn of a PoC…

2 days ago

This website uses cookies.