Arch Linux Security Advisory ASA-202108-12

Severity: Medium
Date : 2021-08-10
CVE-ID : CVE-2021-36156
Package : loki
Type : directory traversal
Remote : Yes
Link : https://security.archlinux.org/AVG-2250

Summary

The package loki before version 2.3.0-1 is vulnerable to directory
traversal.

Resolution

Upgrade to 2.3.0-1.

pacman -Syu “loki>=2.3.0-1”

The problem has been fixed upstream in version 2.3.0.

Workaround

None.

Description

An issue was discovered in Grafana Loki through 2.2.1. The header value
X-Scope-OrgID is used to construct file paths for rules files, and if
crafted to conduct directory traversal such as a
…/…/sensitive/path/in/deployment pathname, then Loki will attempt to
parse a rules file at that location and include some of the contents in
the error message.

Impact

A remote attacker could disclose some of the contents of arbitrary
files through a crafted X-Scope-OrgID header.

References

https://github.com/grafana/loki/pull/4020
https://github.com/grafana/loki/commit/2fd633cded9a97c8c6b29160549a157678d1fa2f
https://security.archlinux.org/CVE-2021-36156