CVE-2024-28867: Swift Prometheus DoS Vulnerability

CVE-2024-28867 Overview

CVE-2024-28867 is an injection vulnerability [CWE-74] in Swift Prometheus, a Swift client library for the Prometheus monitoring system. The library supports counters, gauges, and histograms for application telemetry. When applications pass unsanitized string values into metric names or labels, an attacker can inject newline characters, closing braces (}), or similar control characters via inputs such as a ?lang query parameter. This injection allows the attacker to take over the exported Prometheus format. The flaw is fixed in version 2.0.0-alpha.2.

Critical Impact

Attackers can create unbounded numbers of stored metrics, inflate server memory usage, and inject bogus metrics into the monitoring pipeline, degrading observability and causing denial of service.

Affected Products

• Apple Swift Prometheus 2.0.0-alpha1
• Swift server applications using Swift Prometheus for metrics export
• Prometheus monitoring backends consuming exported metrics from vulnerable services

Discovery Timeline

• 2024-03-29 - CVE-2024-28867 published to NVD
• 2026-01-13 - Last updated in NVD database

Technical Details for CVE-2024-28867

Vulnerability Analysis

The vulnerability stems from improper neutralization of special elements in output used by a downstream component [CWE-74]. Swift Prometheus accepts string values from application code and incorporates them into metric names and labels exported in the Prometheus text-based exposition format. The library does not sanitize control characters such as newlines or } before serialization. When user-controlled input reaches metric labels, an attacker can break out of the intended label context and forge additional metric lines in the exported output.

The Prometheus exposition format relies on newlines as record separators and curly braces to delimit label sets. Injecting these characters lets attackers craft arbitrary metric series that the scraper accepts as legitimate. Each unique label combination creates a new time series stored in memory, enabling cardinality explosion attacks against both the exporter and downstream Prometheus servers.

Root Cause

The root cause is missing input sanitization within the metric serialization path. Swift Prometheus trusted caller-provided strings to be safe for direct concatenation into the exposition format. No escaping or rejection of structural characters such as \n, \r, {, }, or " was performed before writing label values to the output buffer.

Attack Vector

Exploitation requires the target application to forward attacker-controlled input, such as an HTTP query parameter like ?lang=..., into a Swift Prometheus metric label or name. The attacker sends a crafted request containing newline characters and brace characters in the parameter value. When the application records the request and exports metrics, the injected payload appears in the scraped output. A remote, unauthenticated attacker can repeatedly send unique payloads to inflate metric cardinality and exhaust memory. See the GitHub Security Advisory GHSA-x768-cvr2-345r for advisory details.

Detection Methods for CVE-2024-28867

Indicators of Compromise

• Prometheus scrape endpoints returning unexpected metric names or label values containing fragments of HTTP query strings or language codes
• Sudden growth in time series cardinality reported by Prometheus prometheus_tsdb_head_series or scrape target memory usage
• HTTP request logs containing ?lang= or similar parameters with URL-encoded newline characters (%0A, %0D) or braces (%7B, %7D)

Detection Strategies

• Inspect exported /metrics output for malformed lines, duplicate metric names, or label values containing whitespace and control characters
• Monitor Prometheus server logs for parsing warnings on scrape targets running Swift Prometheus
• Review application access logs for query parameters that contain encoded line terminators reaching endpoints whose values are used in metrics

Monitoring Recommendations

• Alert on rapid increases in series count per scrape target using rate(prometheus_tsdb_head_series[5m])
• Track exporter process memory and restart events as a proxy for cardinality-induced exhaustion
• Enable scrape sample limits with sample_limit and label_limit directives in Prometheus scrape configurations to cap blast radius

How to Mitigate CVE-2024-28867

Immediate Actions Required

• Upgrade Swift Prometheus to version 2.0.0-alpha.2 or later across all Swift server applications
• Audit application code paths that pass HTTP parameters, headers, or other untrusted input into metric names or labels
• Apply input validation and allowlisting on values used as Prometheus labels until the upgrade is deployed

Patch Information

The vulnerability is fixed in Swift Prometheus 2.0.0-alpha.2. The upstream fix is published in commit bfcd4bbfabe11aae4b035424ee9724582e288501. Update the dependency declaration in Package.swift and rebuild affected services. Coordinate the rollout with monitoring teams to validate that exported metrics remain well-formed after deployment.

Workarounds

• Strip or reject newline characters, carriage returns, and brace characters from any string before recording it as a metric label or name
• Replace high-cardinality user input with bounded enumerations (for example, map lang values to a fixed allowlist of language codes)
• Configure Prometheus scrape jobs with sample_limit, label_limit, and label_value_length_limit to contain cardinality abuse

# Prometheus scrape configuration example with cardinality limits
scrape_configs:
  - job_name: 'swift-app'
    sample_limit: 10000
    label_limit: 30
    label_name_length_limit: 200
    label_value_length_limit: 200
    static_configs:
      - targets: ['swift-app:9090']