Issue 157: Unsafe defaults in Prometheus, mapping API attack surfaces, OpenAPI file trend analysis
Brief
This week, we have details of a potential vulnerability in existing Prometheus installations with no endpoint security enabled, details of a new tool to assist organizations map their API attack surface, a report on the analysis of publicly available OpenAPI definition files in the public domain, and news on upcoming API security awareness and training from We Hack Purple.
Vulnerability: Unsafe defaults in Prometheus expose secrets
JFrog recently published a report on a potential vulnerability in Prometheus , a popular open-source event monitoring and alerting solution. Attackers could parse unsecured endpoints to retrieve sensitive data.
Previously, the metrics had not been considered sensitive at all, but in version 2.
- 0 support for TLS and basic authentication were added. Unfortunately, because this is a relatively new feature (v2. 24.