Fix for CVE-2021-31232: Alertmanager can expose local files content via specially crafted config

[pracucci]

What this PR does:
This is the public PR for the CVE-2021-31232 fix.

Which issue(s) this PR fixes:
N/A

Checklist

• Tests updated
• Documentation added
• CHANGELOG.md updated - the order of entries should be [CHANGE], [FEATURE], [ENHANCEMENT], [BUGFIX]

[pstibrany]

Thank you!

[alanprot]

Hi @pracucci :D One last question? :D

Is there a specific reason to block proxy_url from the receivers due this CVE?
We are allowing to set other URLs anyway, like the slack or OpsGenie URL, right? So seems that setting up the proxy should be the same?

@alvinlin123 , thoughts?

[pracucci]

Is there a specific reason to block proxy_url from the receivers due this CVE?

I don't remember the details, sorry, but at that time we decided to block all proxy URLs because we thought they could be potentially exploited (but we didn't investigated deeply, maybe was just paranoid).

[alvinlin123]

We should re-enable proxy_url. if today proxy_url has security, then the issue needs to be fixed at the Prometheus' alert manager repo because proxy_url is a config supported by Prometheus alert manager.

My guess for the paranoid that Marco mentioned is because with issue like CVE-2021-31232, proxy_url add to the risk because hackers have more place to hack and gain access to Cortex's local file. But without CVE-2021-31232 there is no risk of enable proxy_url.