Default config exposes /debug/pprof publicly

[riptl]

Issue

When installing the Grafana Cloud Agent (version 0.17.0) according to documented instructions on a server, the agent is going to expose port 12345 to any address (listening at 0.0.0.0) by default.

This server is also exposing the Go pprof debugging API under http://<server>:12345/debug/pprof/.

This is a minor security vulnerability, and common across the Go ecosystem: https://mmcloughlin.com/posts/your-pprof-is-showing
It is likely that any default installations of Grafana Cloud Agent suffer from this problem.

kubelet had the same issue two years ago (CVE-2019-11248). It was rated CVSS 6.4.

• CVE-2019-11248: /debug/pprof exposed on kubelet's healthz port kubernetes/kubernetes#81023
• https://www.cvedetails.com/cve/CVE-2019-11248/

Reproduce

Method 1: All in one script

Follow Grafana Cloud's walkthrough instructions to install Grafana Agent.

Method 2: Manual config generator

Run the following command:

grafana-agentctl cloud-config -u <user> -p "<api_key>"

Substitute <user> for your Grafana Cloud username (numeric) and <api_key> for your API key (beginning with ey...).

It would generate a config like so:

...
server:
  http_listen_port: 12345

When looking at the server config, this will indeed run the service under 0.0.0.0:12345: https://grafana.com/docs/agent/latest/configuration/server-config/

# HTTP server listen host. Used for Agent metrics, integrations, and the Agent
# API.
[http_listen_address: <string> | default = "0.0.0.0"]

# HTTP server listen port
[http_listen_port: <int> | default = 80]

Finally, on your server:

$ sudo netstat -ltupn | grep 12345
tcp6       0      0 :::12345                :::*                    LISTEN      15538/grafana-agent 

Fix

The fix is simple: Default http_listen_address to 127.0.0.1.

PS, I could not find any channels for responsible disclosure on your website nor this repo, so I decided to post it here, since the severity is quite low.

[rfratto]

Thanks for reporting. I will talk with the team about this to decide next steps.