Bug 1850572 (CVE-2018-18624)

Summary:	CVE-2018-18624 grafana: XSS vulnerability via a column style on the "Dashboard > Table Panel" screen
Product:	[Other] Security Response	Reporter:	Michael Kaplan <mkaplan>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	agerstmayr, alegrand, anpicker, bmontgom, eparis, erooth, grafana-maint, hvyas, jburrell, jkurik, jokerman, kakkoyun, kconner, lcosic, mcooper, mgoodwin, mloibl, nathans, nstielau, pkrupa, puebele, rcernich, sponnaga, surbania
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	grafana 6.7.3, grafana 7.0.0	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in grafana. An incomplete fix for CVE-2018-12099 allows for a XSS via a column style on the "Dashboard > Table Panel" screen.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-10-27 20:21:23 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1850573, 1851885, 1852023, 1852024, 1852025, 1852026, 1852260, 1852261
Bug Blocks:	1850581

Description Michael Kaplan 2020-06-24 13:48:55 UTC

Grafana 5.3.1 has XSS via a column style on the "Dashboard > Table Panel" screen. NOTE: this issue exists because of an incomplete fix for CVE-2018-12099.

https://github.com/grafana/grafana/pull/11813
https://security.netapp.com/advisory/ntap-20200608-0008/

Comment 1 Michael Kaplan 2020-06-24 13:49:14 UTC

Created grafana tracking bugs for this issue:

Affects: fedora-all [bug 1850573]

Comment 2 Mark Cooper 2020-06-26 04:34:00 UTC

Upstream commit: https://github.com/grafana/grafana/commit/0284747c88eb9435899006d26ffaf65f89dec88e

Comment 3 Mark Cooper 2020-06-26 04:45:55 UTC

ServiceMesh packages a vulnerable version of grafana v6.4.3 in the openshift-service-mesh/grafana-rhel8 container.

Comment 7 Przemyslaw Roguski 2020-06-29 15:34:39 UTC

upstream PR: https://github.com/grafana/grafana/pull/23816

Comment 11 Mark Cooper 2020-06-30 08:11:31 UTC

Statement:

Both OpenShift 3.11 and 4.x grafana-container's package a vulnerable version of grafana. However the grafana instance is set to read-only meaning that the potential XSS attack cannot be performed as the table panel cannot be modified or added. As OpenShift still packages the vulnerable code, the components are affected but with impact Low.

In OpenShift ServiceMesh the grafana component is a vulnerable version, however as it is behind OpenShift OAuth restricting access to authenticated users only the impact is Low.

Comment 12 Hardik Vyas 2020-06-30 11:41:59 UTC

External References:

https://security.netapp.com/advisory/ntap-20200608-0008/

Comment 14 errata-xmlrpc 2020-10-27 16:24:30 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.6

Via RHSA-2020:4298 https://access.redhat.com/errata/RHSA-2020:4298

Comment 15 Product Security DevOps Team 2020-10-27 20:21:23 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2018-18624

Comment 16 errata-xmlrpc 2020-11-04 02:59:45 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2020:4682 https://access.redhat.com/errata/RHSA-2020:4682