CSRF Bypass in Basecamp Upright Alertmanager

Executive Summary

This is a Cross-Site Request Forgery (CSRF) vulnerability in basecamp/upright at a specific commit. The Rails CSRF protection is disabled for Alertmanager and Prometheus proxy controllers. An unauthenticated attacker can trick a logged-in user's browser into sending requests to upstream endpoints, such as creating Alertmanager silences or triggering Prometheus reloads.

Useful 0 Not Useful 0

Detection Guidance

Check if Rails CSRF protection is disabled in the PrometheusProxyController or AlertmanagerProxyController files by inspecting the code for skip_forgery_protection. Verify if the controllers proxy requests to upstream write endpoints without authentication. Use network monitoring to detect unauthorized requests to Alertmanager or Prometheus management APIs.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to perform unauthorized actions on your behalf if you are logged into the system. This includes creating alerts, modifying configurations, or reloading services, depending on what upstream APIs are enabled.

Useful 0 Not Useful 0

Mitigation Strategies

Enable CSRF protection in the affected controllers by removing skip_forgery_protection. Ensure all proxy endpoints require authentication. Update to a patched version of upright if available. Restrict network access to Alertmanager and Prometheus management APIs.

Useful 0 Not Useful 0