Description

basecamp/upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f disables Rails CSRF protection for its Alertmanager and Prometheus proxy controllers. An unauthenticated attacker can induce a logged-in user's browser to submit requests that are forwarded to enabled upstream write or management endpoints, such as creating an Alertmanager silence or requesting a Prometheus reload. The final impact depends on the APIs enabled by the upstream services.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-13T14:17:11.580Z",
  "pubdate": "2026-08-13T14:17:11.580Z",
  "executiveSummary": "A vulnerability exists in basecamp/upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f, specifically involving the disabling of Ruby on Rails Cross-Site Request Forgery (CSRF) protection within the Alertmanager and Prometheus proxy controllers. This security deficiency allows an unauthenticated remote attacker to craft malicious web pages or links designed to induce an authenticated, logged-in user's browser into implicitly submitting unauthorized state-changing HTTP requests. These forged requests are subsequently proxied and forwarded by the vulnerable application to active upstream write or management endpoints. The realization of risk and downstream impact is contingent upon the specific APIs and administrative functionalities enabled on the upstream services, potentially permitting unintended actions such as generating Alertmanager silences or triggering administrative routines like Prometheus configuration reloads. Successful exploitation requires the targeted victim to maintain an active authenticated session with the application while interacting with attacker-controlled content, bypassing standard browser-based same-origin protections through the direct abuse of weakened server-side validation configurations in the proxy controllers.",
  "technicalDetails": "The root cause of this vulnerability lies in the explicit disabling or omission of Ruby on Rails built-in CSRF protection mechanisms (such as protect_from_forgery) within the proxy controllers responsible for handling communication with Alertmanager and Prometheus services. Standard web application frameworks rely on anti-CSRF tokens to verify that state-changing requests originate intentionally from the authenticated user interface rather than via cross-site request forgery vectors. By bypassing this security control, the application accepts incoming requests without validating cryptographic tokens.\nThe vulnerable components are the Alertmanager proxy controller and the Prometheus proxy controller implemented within the basecamp/upright codebase at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f. Because these controllers lack proper request validation, they blindly proxy incoming HTTP requests originating from a user's browser directly to downstream monitoring and management infrastructure.\nThe attack flow proceeds as follows: An unauthenticated attacker constructs a malicious external website or phishing payload containing automated JavaScript or HTML form elements targeting the vulnerable basecamp/upright proxy endpoints. The attacker lures a victim, who possesses an active authenticated session with the upright application, into visiting the malicious resource. The victim's browser automatically includes valid session cookies and credentials when rendering or executing the request payload directed at the upstream proxy controllers. The upright application receives the request, fails to validate any CSRF tokens due to the insecure configuration, and forwards the payload to the internal upstream services.\nThe payload behavior and post-exploitation impact depend entirely on the configuration and exposure of the upstream Alertmanager and Prometheus APIs. If write permissions or administrative endpoints are enabled upstream, the forwarded requests can execute unauthorized operations. Examples include creating new Alertmanager silences to suppress critical alerting infrastructure or issuing commands to request a Prometheus configuration reload. The attack requires no prior authentication or privileges from the perspective of the external attacker, though it entirely depends on the victim user's authenticated session state and browser context."
}