Bug 1850575 (CVE-2018-18625)

Summary:	CVE-2018-18625 grafana: XSS vulnerability via a link on the "Dashboard > All Panels > General" screen
Product:	[Other] Security Response	Reporter:	Michael Kaplan <mkaplan>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	agerstmayr, amctagga, anharris, anpicker, bmontgom, bniver, eparis, erooth, flucifre, gmeno, grafana-maint, hvyas, jburrell, jkurik, jokerman, lcosic, mbenjamin, mgoodwin, mhackett, nathans, nstielau, rcernich, sponnaga, surbania, vereddy
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	grafana 6.3.0	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in grafana. An incomplete fix for CVE-2018-12099 allows for a XSS via a column style on the "Dashboard > All Panels > General" screen.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-10-28 08:24:40 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1850584, 1852264, 1852346, 1852347, 1852348, 1852349
Bug Blocks:	1850581

Description Michael Kaplan 2020-06-24 13:50:33 UTC

Grafana 5.3.1 has XSS via a link on the "Dashboard > All Panels > General" screen. NOTE: this issue exists because of an incomplete fix for CVE-2018-12099.

https://github.com/grafana/grafana/pull/11813
https://security.netapp.com/advisory/ntap-20200608-0008/

Comment 1 Michael Kaplan 2020-06-24 13:54:05 UTC

Created grafana tracking bugs for this issue:

Affects: fedora-all [bug 1850584]

Comment 3 Mark Cooper 2020-06-29 03:50:00 UTC

This vulnerability actually applies to the "dashboard" field at "Home > Edit Panel > Add Link > General > Dashboard" after the dashboard title has been set: https://github.com/grafana/grafana/pull/11813#issuecomment-458000030

Comment 9 Mark Cooper 2020-06-30 07:03:55 UTC

OpenShift packages a vulnerable version of grafana:
  - OpenShift 3.11 grafana v5.2.3

ServiceMesh also packages a vulnerable version:
  - ServiceMesh 1.0.x grafana v6.2.2

For Openshift 4.x and SeviceMesh 1.1.x the version of grafana is 6.4.3 and is not vulnerable.

Comment 15 Mauro Matteo Cascella 2020-06-30 15:17:26 UTC

Statement:

While OpenShift 3.11 grafana-container packages a vulnerable version of grafana, the dashboard is set to read-only meaning that the vulnerable component cannot be added or modified to contain the potential XSS. As OpenShift still packages the vulnerable code, the component is affected but with impact Low.

In OpenShift ServiceMesh 1.0 the grafana component is a vulnerable version, however as it is behind OpenShift OAuth restricting access to authenticated users only the impact is Low.

Red Hat Enterprise Linux 8 is not affected by this flaw, as it ships a newer version of grafana which does not include the vulnerable code.

Comment 16 Mark Cooper 2020-07-01 01:22:06 UTC

@proguski has confirmed with upstream that this vulnerability was fixed in v6.3.0 as per this comment: https://github.com/grafana/grafana/pull/22680#issuecomment-651195921

Comment 17 Mark Cooper 2020-07-01 01:22:12 UTC

External References:

https://security.netapp.com/advisory/ntap-20200608-0008/
https://github.com/grafana/grafana/pull/22680#issuecomment-651195921