Bug 2137913 (CVE-2022-39328)

Summary: CVE-2022-39328 grafana: race condition allowing privilege escalation
Product: [Other] Security Response Reporter: Anten Skrabec <askrabec>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED NOTABUG QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: agerstmayr, anstephe, aoconnor, avibelli, bgeorges, bniver, chazlett, clement.escoffier, dandread, dkreling, flucifre, gmeno, gparvin, grafana-maint, gsmet, hamadhan, jcantril, jkurik, jochrist, jwendell, jwon, lthon, mbenjamin, mhackett, nathans, njean, ntait, owatkins, pahickey, peholase, periklis, pgallagh, pjindal, probinso, rcernich, rruss, rsvoboda, sbiarozk, scox, sdouglas, security-response-team, sostapov, stcannon, teagle, twalsh, vereddy
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: grafana 9.2.4 grafana 8.5.15 Doc Type: If docs needed, set a value
Doc Text:
A race condition was found in Grafana in the middleware logic that could allow bypassing authentication. This flaw allows an unauthenticated user to successfully query an administration endpoint under a heavy load by using a load testing script hitting specific endpoints.
 Story Points: ---
Clone Of: Environment:
Last Closed: 2023-03-03 21:47:23 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2137894    

Description Anten Skrabec 2022-10-26 14:54:29 UTC 
A race condition was found in the middleware logic that when exploited the user could bypass the authentication middleware. Using a load testing script hitting specific endpoints, an unauthenticated user could query successfully an administration endpoint under heavy load.

This impacts only 9.2.0 and 9.2.1.
Comment 25 Product Security DevOps Team 2023-03-03 21:47:19 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-39328