CVE-2023-26735
📋 TL;DR
CVE-2023-26735 is an access control vulnerability in blackbox_exporter v0.23.0 that allows attackers to probe internal network ports and services through the probe interface. This can lead to information disclosure about internal infrastructure. Organizations using blackbox_exporter v0.23.0 without proper authentication are affected.
💻 Affected Systems
- Prometheus blackbox_exporter
📦 What is this software?
Blackbox Exporter by Prometheus
⚠️ Risk & Real-World Impact
Worst Case
Attackers map internal network topology, discover sensitive services, and potentially download internal resources, enabling further attacks.
Likely Case
Information disclosure about internal services and ports, potentially revealing vulnerable systems for targeted attacks.
If Mitigated
Minimal impact if proper authentication is configured as recommended by the vendor.
🎯 Exploit Status
Exploitation requires network access to blackbox_exporter probe interface; no authentication bypass needed if not configured.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v0.24.0 and later
Vendor Advisory: https://github.com/prometheus/blackbox_exporter/issues/1024
Restart Required: Yes
Instructions:
1. Backup current configuration. 2. Download blackbox_exporter v0.24.0 or later from GitHub releases. 3. Replace binary and restart service. 4. Verify authentication is properly configured.
🔧 Temporary Workarounds
Enable authentication
allConfigure TLS and basic authentication for blackbox_exporter as documented
# Configure basic auth in blackbox_exporter.yml
# See: https://github.com/prometheus/blackbox_exporter#tls-and-basic-authentication
Network segmentation
linuxRestrict access to blackbox_exporter probe interface using firewall rules
# Example iptables rule to restrict access
iptables -A INPUT -p tcp --dport 9115 -s trusted_network -j ACCEPT
iptables -A INPUT -p tcp --dport 9115 -j DROP
🧯 If You Can't Patch
- Enable authentication with strong credentials immediately
- Implement network controls to restrict access to blackbox_exporter to trusted sources only
🔍 How to Verify
Check if Vulnerable:
Check if running blackbox_exporter v0.23.0 and if authentication is not configured in blackbox_exporter.ymlCheck Version:
./blackbox_exporter --versionVerify Fix Applied:
Verify version is v0.24.0+ and authentication is properly configured and tested📡 Detection & Monitoring
Log Indicators:
- Unauthorized probe requests from unexpected sources
- Multiple failed authentication attempts
Network Indicators:
- Unusual port scanning patterns originating from blackbox_exporter host
- Probe requests to internal IP ranges from external sources
SIEM Query:
source="blackbox_exporter" AND (event="probe" AND NOT src_ip IN [trusted_ips])🔗 References
- http://blackboxexporter.com
- http://prometheus.com
- https://github.com/prometheus/blackbox_exporter#tls-and-basic-authentication
- https://github.com/prometheus/blackbox_exporter/issues/1024
- https://github.com/prometheus/blackbox_exporter/issues/1025
- https://github.com/prometheus/blackbox_exporter/issues/1026
- http://blackboxexporter.com
- http://prometheus.com
- https://github.com/prometheus/blackbox_exporter#tls-and-basic-authentication
- https://github.com/prometheus/blackbox_exporter/issues/1024
- https://github.com/prometheus/blackbox_exporter/issues/1025
- https://github.com/prometheus/blackbox_exporter/issues/1026
- https://github.com/prometheus/blackbox_exporter#tls-and-basic-authentication
