Bug 1892418 (CVE-2020-24303)

Summary:	CVE-2020-24303 grafana: XSS via a query alias for the Elasticsearch and Testdata datasource
Product:	[Other] Security Response	Reporter:	Guilherme de Almeida Suckevicz <gsuckevi>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	agerstmayr, alegrand, amctagga, anharris, anpicker, bmontgom, bniver, dramseur, eparis, erooth, flucifre, gmeno, grafana-maint, hvyas, jburrell, jhunter, jkurik, jokerman, jwendell, kakkoyun, kconner, kmitts, lcosic, mbenjamin, mgala, mgoodwin, mhackett, mjudeiki, nathans, nstielau, pkrupa, puebele, rcernich, sponnaga, surbania, twalsh, vereddy
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	grafana 7.1.0	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in grafana. A XSS via a query alias for the ElasticSearch datasource is allowed.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-05-18 20:36:55 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1892419, 1892626, 1892627, 1893150, 1894024, 1898716, 1899118
Bug Blocks:	1892421

Description Guilherme de Almeida Suckevicz 2020-10-28 18:18:17 UTC

Grafana before 7.1.0-beta 1 allows XSS via a query alias for the ElasticSearch datasource.

References:
https://github.com/grafana/grafana/blob/master/CHANGELOG.md#710-beta-1-2020-07-01
https://github.com/grafana/grafana/pull/25401

Comment 1 Guilherme de Almeida Suckevicz 2020-10-28 18:18:34 UTC

Created grafana tracking bugs for this issue:

Affects: fedora-all [bug 1892419]

Comment 2 Przemyslaw Roguski 2020-10-29 10:33:40 UTC

Upstream fix pr:
https://github.com/grafana/grafana/pull/25401

Comment 3 Przemyslaw Roguski 2020-10-29 10:33:46 UTC

External References:

https://github.com/grafana/grafana/pull/25401

Comment 12 Sage McTaggart 2020-11-17 21:18:05 UTC

Statement:

A vulnerable version of Grafana is shipped in OpenShift 3.11 - 4.5 and OpenShift ServiceMesh, however Prometheus is used as a data source and modification to Elasticsearch or Testdata requires full control of the grafana component. Access is restricted to authenticated users only by OpenShift OAuth. As OpenShift and OpenShift ServiceMesh still packages the vulnerable code, the components are affected but with impact Low. OpenShift 4.6 uses version 7.2.0 of Grafana in openshift4/ose-grafana-container and is not affected.

Red Hat Ceph Storage 3 and 4 ship a vulnerable version of grafana, however, Prometheus is used as the data source., and thus the impact is rated as low. 

Red Hat Gluster Storage 3 ships vulnerable version of grafana, however Graphite is the only supported data source and hence this issue has been rated as having a security impact of Low.

Comment 16 errata-xmlrpc 2021-05-18 15:39:09 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:1859 https://access.redhat.com/errata/RHSA-2021:1859

Comment 17 Product Security DevOps Team 2021-05-18 20:36:55 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-24303