Restrict path segments in TenantIDs (CVE-2021-36157)

[simonswine]

What this PR does:

This prevents paths derived from TenantIDs to become vulnerable to path traversal attacks. CVE-2021-36157

Edit added more details.

An attacker, with suitable access, could trick Cortex into sending the contents of files it has access to.

The vulnerability is that the header value X-Scope-OrgID is used to construct file paths for rules files, and if crafted to say something like ../../sensitive/path/in/deployment then Cortex will attempt to parse a rules file at that location and include some of the contents in the error message.

Other Cortex API requests can also be sent a malicious OrgID header, e.g. tricking the ingester into writing metrics to a different location, but the effect is nuisance rather than disclosure.

The severity is rated as Medium

Mitigations:

• If you have a proxy in front of Cortex that supplies the OrgID header, so it cannot be crafted by an attacker, then you are not vulnerable. We always recommend such a proxy - https://cortexmetrics.io/docs/guides/auth/

• If you run Cortex with limited access to sensitive files, e.g. in a container or chroot, and as a user with limited access, then this will constrain the vulnerability to that access.

[pracucci]

Thanks!