CVE-2021-36156

Vulnerability

Grafana Loki versions through 2.2.1 use the X-Scope-OrgID header value to construct file paths for rules files. A crafted header containing directory traversal sequences (e.g., ../../sensitive/path/in/deployment) causes Loki to attempt to parse a rules file at the attacker-specified location and include parts of its content in the resulting error message [1][4].

Exploitation

An attacker sends an HTTP request to Loki with a malicious X-Scope-OrgID header containing path traversal payloads. No authentication is required if the header is user-controllable; the attacker does not need special network position beyond access to the Loki API. The server’s response will include portions of the targeted file in the error output [4].

Impact

Successful exploitation leads to information disclosure: the attacker can read arbitrary files that the Loki process has access to. The severity depends on the sensitivity of the exposed files (e.g., configuration files, secrets). The vulnerability does not directly enable code execution or privilege escalation, but the leaked information may facilitate further attacks [1][4].

Mitigation

• Upgrade to Grafana Loki version 2.3.0 or later, which includes the fix from pull request #4020 [2][4].
• If upgrading is not immediately possible, restrict the X-Scope-OrgID header by placing a proxy in front of Loki that validates or supplies the header, preventing attacker control [4].
• Run Loki inside a container or chroot with limited file system access to constrain the set of readable files [4].