CVE-2023-22497

{"id": "CVE-2023-22497", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.2, "exploitabilityScore": 2.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "published": "2023-01-14T02:15:10.483", "references": [{"url": "https://github.com/netdata/netdata/releases/tag/v1.37.0", "tags": ["Release Notes", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/netdata/netdata/security/advisories/GHSA-jx85-39cw-66f2", "tags": ["Exploit", "Mitigation", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/netdata/netdata/releases/tag/v1.37.0", "tags": ["Release Notes", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/netdata/netdata/security/advisories/GHSA-jx85-39cw-66f2", "tags": ["Exploit", "Mitigation", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-287"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-668"}]}], "descriptions": [{"lang": "en", "value": "Netdata is an open source option for real-time infrastructure monitoring and troubleshooting. Each Netdata Agent has an automatically generated MACHINE GUID. It is generated when the agent first starts and it is saved to disk, so that it will persist across restarts and reboots. Anyone who has access to a Netdata Agent has access to its MACHINE_GUID. Streaming is a feature that allows a Netdata Agent to act as parent for other Netdata Agents (children), offloading children from various functions (increased data retention, ML, health monitoring, etc) that can now be handled by the parent Agent. Configuration is done via `stream.conf`. On the parent side, users configure in `stream.conf` an API key (any random UUID can do) to provide common configuration for all children using this API key and per MACHINE GUID configuration to customize the configuration for each child. The way this was implemented, allowed an attacker to use a valid MACHINE_GUID as an API key. This affects all users who expose their Netdata Agents (children) to non-trusted users and they also expose to the same users Netdata Agent parents that aggregate data from all these children. The problem has been fixed in: Netdata agent v1.37 (stable) and Netdata agent v1.36.0-409 (nightly). As a workaround, do not enable streaming by default. If you have previously enabled this, it can be disabled. Limiting access to the port on the recipient Agent to trusted child connections may mitigate the impact of this vulnerability."}, {"lang": "es", "value": "Netdata es una opci\u00f3n de c\u00f3digo abierto para monitoreo y resoluci\u00f3n de problemas de infraestructura en tiempo real. Cada agente Netdata tiene un GUID DE M\u00c1QUINA generado autom\u00e1ticamente. Se genera cuando el agente se inicia por primera vez y se guarda en el disco, de modo que persistir\u00e1 durante los reinicios y los reinicios. Cualquiera que tenga acceso a un Agente de Netdata tiene acceso a su MACHINE_GUID. La transmisi\u00f3n es una caracter\u00edstica que permite que un Agente de Netdata act\u00fae como padre de otros Agentes de Netdata (hijos), descargando a los hijos de diversas funciones (mayor retenci\u00f3n de datos, ML, monitoreo de salud, etc.) que ahora pueden ser manejadas por el Agente principal. La configuraci\u00f3n se realiza a trav\u00e9s de `stream.conf`. En el lado de los padres, los usuarios configuran en `stream.conf` una clave API (cualquier UUID aleatorio puede servir) para proporcionar una configuraci\u00f3n com\u00fan para todos los hijos que usan esta clave API y por configuraci\u00f3n GUID DE M\u00c1QUINA para personalizar la configuraci\u00f3n para cada hijo. La forma en que se implement\u00f3 esto permiti\u00f3 a un atacante usar un MACHINE_GUID v\u00e1lido como clave API. Esto afecta a todos los usuarios que exponen sus agentes Netdata (hijos) a usuarios que no son de confianza y tambi\u00e9n exponen a los mismos usuarios a los padres de los agentes Netdata que agregan datos de todos estos hijos. El problema se solucion\u00f3 en: Netdata Agent v1.37 (estable) y Netdata Agent v1.36.0-409 (todas las noches). Como workaround, no habilite la transmisi\u00f3n por streaming de forma predeterminada. Si ha habilitado esto anteriormente, puede deshabilitarlo. Limitar el acceso al puerto del Agente destinatario a conexiones secundarias confiables puede mitigar el impacto de esta vulnerabilidad."}], "lastModified": "2024-11-21T07:44:55.630", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:netdata:netdata:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9B7BA18D-438F-4098-8D0E-9A25F07C5BAB", "versionEndExcluding": "1.37.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}