Bug 2168038 (CVE-2023-0507)

Summary:	CVE-2023-0507 grafana: cross site scripting
Product:	[Other] Security Response	Reporter:	Avinash Hanwate <ahanwate>
Component:	vulnerability	Assignee:	Nobody <nobody>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	amctagga, aoconnor, bniver, dfreiber, flucifre, gmeno, gparvin, grafana-maint, jburrell, jkurik, jwendell, mbenjamin, mhackett, nathans, njean, ovanders, owatkins, pahickey, rcernich, rogbas, sostapov, stcannon, teagle, vereddy, vkumar
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in the GeoMap Grafana plugin, where a user can store unsanitized HTML in the GeoMap plugin under the Attribution text field, and the client will process it. The vulnerability makes it possible to use XHR to make arbitrary API calls on behalf of the attacked user. This means that a malicious user with editor permissions could alter a GeoMap panel to include JavaScript that changes the password for the user viewing the panel (this could be an admin) to a known password, thus gaining access to the admin account and resulting as the editor becoming an admin.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2172061, 2172773, 2174477
Bug Blocks:	2168039

Description Avinash Hanwate 2023-02-08 05:14:48 UTC

We discovered that one can store unsanitized HTML in the GeoMap plugin under the Attribution text field and it will be processed by the client. The vulnerability makes it possible to use XHR to make arbitrary API calls on behalf of the attacked user. This means that a malicious user with editor permissions could alter a GeoMap panel to include JavaScript that changes the password for the user viewing the panel (this could be an admin) to a known password, thus getting access to the admin account (so the editor would become an admin as an end result).

Comment 6 Guilherme de Almeida Suckevicz 2023-03-01 18:24:46 UTC

Created grafana tracking bugs for this issue:

Affects: fedora-all [bug 2174477]

Comment 8 errata-xmlrpc 2024-02-08 16:58:06 UTC

This issue has been addressed in the following products:

  Red Hat Ceph Storage 5.3

Via RHSA-2024:0746 https://access.redhat.com/errata/RHSA-2024:0746