CVE-2022-46156 Information

Description

The Synthetic Monitoring Agent for Grafana’s Synthetic Monitoring application provides probe functionality and executes network checks for monitoring remote targets. Users running the Synthetic Monitoring agent prior to version 0.12.0 in their local network are impacted. The authentication token used to communicate with the Synthetic Monitoring API is exposed through a debugging endpoint. This token can be used to retrieve the Synthetic Monitoring checks created by the user and assigned to the agent identified with that token. The Synthetic Monitoring API will reject connections from already-connected agents so access to the token does not guarantee access to the checks. Version 0.12.0 contains a fix. Users are advised to rotate the agent tokens. After upgrading to version v0.12.0 or later it’s recommended that users of distribution packages review the configuration stored in /etc/synthetic-monitoring/synthetic-monitoring-agent.conf specifically the API_TOKEN variable which has been renamed to SM_AGENT_API_TOKEN. As a workaround for previous versions it’s recommended that users review the agent settings and set the HTTP listening address in a manner that limits the exposure for example localhost or a non-routed network by using the command line parameter -listen-address e.g. -listen-address localhost:4050.

Reference

https://github.com/grafana/synthetic-monitoring-agent/security/advisories/GHSA-9j4f-f249-q5w8 https://github.com/grafana/synthetic-monitoring-agent/pull/375 https://github.com/grafana/synthetic-monitoring-agent/pull/374 https://github.com/grafana/synthetic-monitoring-agent/pull/373 https://github.com/grafana/synthetic-monitoring-agent/commit/d8dc7f9c1c641881cbcf0a09e178b90ebf0f0228 https://github.com/grafana/synthetic-monitoring-agent/releases/tag/v0.12.0