[⭐] Exposed Prometheus Metrics Endpoint

⭐ Challenge idea

Description

Modern services often expose metrics about the current state of the service / server on a /metrics endpoint. This endpoint is then scraped by systems like prometheus to gather these metrics over time.

These metrics endpoint is not really intended for “normal” users. Yet prometheus security model explicitly states that is is expected that untrusted users should be able to access the metrics data, see https://prometheus.io/docs/operating/security/#prometheus. In the security review performed by the CNCF this was mentioned but later decided to ignore as expected behavior by prometheus team. (See https://prometheus.io/assets/downloads/2018-06-11--cure53_security_audit.pdf PRM-01-002: Clients leak Metrics data thought unprotected endpoints)

Normal setups try not to expose approaches include routing the /metrics endpoint to a 404 page via a loadbalancer / reverse proxy sitting in front of the application. Or protect the endpoint using http basic auth.

The Juice Shop could have its own /metrics endpoint exposing Juice Shop related metrics to the instance, obviously exposed via any auth / protection.

• Orders completed
• Juices sold
• Users signed up
• Challenges solved

Adding this challenge would also mean that one could use prometheus / grafana to monitor all their Juice Shop instances 😉

Adding such metrics would also be relatively easy using: https://github.com/siimon/prom-client

Underlying vulnerability/ies

I don’t think there is a CVE or anything open for it.

In OWASP Top 10 terms would probably be a “Security Misconfiguration” or “Sensitive Data Exposure” Challenge.

Expected difficulty

✔️ / ❌	Difficulty
✔️	⭐
✔️	⭐⭐
❌	⭐⭐⭐
❌	⭐⭐⭐⭐
❌	⭐⭐⭐⭐⭐
❌	⭐⭐⭐⭐⭐⭐

Possible attack flow

1. Open Browser.
2. Open /metrics endpoint.
3. Profit of all the juicy information 😉

[bkimminich]

Great job, @Scar26! Thank you! Please send me an email with your address so I can send you a couple of stickers!

[github-actions[bot]]

This thread has been automatically locked because it has not had recent activity after it was closed. 🔒 Please open a new issue for regressions or related bugs.