Postgres-Exporter Debug Endpoints Information Disclosure

Executive Summary

This vulnerability is in postgres-exporter where debug endpoints are exposed on the unauthenticated metrics listener due to a blank import of net/http/pprof. A remote attacker within the cluster network can access these endpoints, leading to information disclosure such as process arguments, goroutine stacks, and sensitive data like database credentials. Repeated CPU profiling can also cause a denial of service.

Useful 0 Not Useful 0

Detection Guidance

Check if the postgres-exporter metrics endpoint is accessible without authentication. Use curl to query the endpoint: curl http://<target-ip>:<port>/debug/pprof/. If debug endpoints respond, the system is vulnerable.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to access sensitive information like database connection strings or passwords, potentially leading to unauthorized data access or further attacks. The denial of service risk could disrupt services relying on the exporter.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Compliance may be compromised due to potential data breaches.

Useful 0 Not Useful 0

Mitigation Strategies

Disable the debug endpoints by removing the blank import of net/http/pprof in the postgres-exporter configuration. Restart the service and verify the endpoints are no longer accessible.

Useful 0 Not Useful 0