[WIP/DNM] CVE: Fix Receiver malicious tenant

If running as root or with enough privileges, receiver can create a directory outside of the configured TenantHeader. This commit fixes it up by sanitizing the user input and explicity not allowing such behavior. Signed-off-by: Daniel Mellado <[email protected]>
thanos-io · Dec 19, 2022 · 92c8fc1 · 92c8fc1
1 parent a89dd0c
commit 92c8fc1
Show file tree

Hide file tree

Showing 4 changed files with 21 additions and 15 deletions.
diff --git a/internal/cortex/querier/queryrange/queryrange.pb.go b/internal/cortex/querier/queryrange/queryrange.pb.go
diff --git a/pkg/receive/handler.go b/pkg/receive/handler.go
@@ -12,18 +12,20 @@ import (
 	stdlog "log"
 	"net"
 	"net/http"
+	"path"
 	"sort"
 	"strconv"
 	"sync"
 	"time"
 
+	"github.com/mwitkow/go-conntrack"
+	"github.com/opentracing/opentracing-go"
+
 	"github.com/go-kit/log"
 	"github.com/go-kit/log/level"
 	"github.com/gogo/protobuf/proto"
 	"github.com/jpillora/backoff"
 	"github.com/klauspost/compress/s2"
-	"github.com/mwitkow/go-conntrack"
-	"github.com/opentracing/opentracing-go"
 	"github.com/pkg/errors"
 	"github.com/prometheus/client_golang/prometheus"
 	"github.com/prometheus/client_golang/prometheus/promauto"
@@ -413,6 +415,11 @@ func (h *Handler) receiveHTTP(w http.ResponseWriter, r *http.Request) {
 		tenant = h.options.DefaultTenantID
 	}
 
+	if tenant != path.Base(tenant) {
+		http.Error(w, err.Error(), http.StatusInternalServerError)
+		return
+	}
+
 	if h.options.TenantField != "" {
 		tenant, err = h.getTenantFromCertificate(r)
 		if err != nil {

diff --git a/pkg/rules/rulespb/rpc.pb.go b/pkg/rules/rulespb/rpc.pb.go
diff --git a/pkg/store/storepb/types.pb.go b/pkg/store/storepb/types.pb.go