Pyroscope Storage Secret Exposure Vulnerability

A vulnerability exists in Pyroscope, an open-source continuous profiling database, when Tencent Cloud Object Storage (COS) is used as the storage backend. In this scenario, an attacker could extract the 'secret_key' configuration value from the Pyroscope API. Exploitation requires direct access to the Pyroscope API. It is recommended to limit the public internet exposure of databases to trusted users or internal systems.

Impact

Exploitation of this vulnerability could lead to the unauthorized disclosure of the 'secret_key' configuration value, potentially allowing for further attacks or unauthorized access.

Remediation

Users can upgrade to Pyroscope versions 1.15.2 and above, 1.16.1 and above, or 1.17.0 and above to address this vulnerability.