Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-rc.0, list endpoints used with the file-system database bind the request-controlled project query parameter into the resource Query structure without validating it against directory traversal characters, and the resulting project value is used to select database paths. An authenticated attacker can supply directory traversal segments to leave the intended project directory, read arbitrary YAML or JSON files accessible to the Perses process, and bypass project isolation to enumerate other file-backed resources.
This issue is fixed in version 0.54.0-rc.0.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
None
No data modification
Availability
None
No disruption
CVSS Vector v4.0
Weakness Type (CWE)
References 3
https://github.com/perses/perses/commit/75e5471040ccb5674ea8d25c2aa16c80ccb70b2a
security-advisories@github.com
https://github.com/perses/perses/releases/tag/v0.54.0-rc.0
security-advisories@github.com
https://github.com/perses/perses/security/advisories/GHSA-vr5f-w35q-98jp
security-advisories@github.com