Bug 2210848 (CVE-2023-2183)

Summary:	CVE-2023-2183 grafana: missing access control allows test alerts by underprivileged user
Product:	[Other] Security Response	Reporter:	Anten Skrabec <askrabec>
Component:	vulnerability	Assignee:	Nobody <nobody>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	amctagga, aoconnor, bniver, dfreiber, flucifre, gmeno, gparvin, grafana-maint, jburrell, jkurik, jwendell, mbenjamin, mhackett, nathans, njean, owatkins, pahickey, rcernich, rogbas, sostapov, stcannon, teagle, twalsh, vereddy, vkumar
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	grafana 9.5.3, grafana 9.4.12, grafana 9.3.15, grafana 9.2.19, grafana 8.5.26	Doc Type:	---
Doc Text:	A flaw was found in grafana. This issue may allow a malicious user to craft a request to the API that enables them to send alert messages via the "API Alert - Test".	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2210912, 2210913, 2210914, 2210919, 2214616
Bug Blocks:	2209803

Description Anten Skrabec 2023-05-29 18:09:05 UTC

CVE-2023-2183 Broken access control test alerts

The application allows an attacker in the Viewer role, send alerts by API Alert - Test. The option is not available from the user panel UI for the Viewer role.

The API does not check access to this function and allows it by users with the least rights, for example, the Viewer that does not see this option in the user panel. This enables malicious users to abuse the functionality by sending multiple alert messages (e-mail, slack, etc…), spamming users, prepare Phishing attack or blocked SMTP server / IP and automatically moved all message to spam folder, add to black list IP.

Affected Versions
Grafana 8.5 - Grafana 10

Comment 5 Avinash Hanwate 2023-06-13 15:26:31 UTC

Created grafana tracking bugs for this issue:

Affects: fedora-all [bug 2214616]

Comment 7 errata-xmlrpc 2023-12-12 13:55:29 UTC

This issue has been addressed in the following products:

  Red Hat Ceph Storage 6.1

Via RHSA-2023:7740 https://access.redhat.com/errata/RHSA-2023:7740

Comment 8 errata-xmlrpc 2023-12-12 13:56:25 UTC

This issue has been addressed in the following products:

  Red Hat Ceph Storage 6.1

Via RHSA-2023:7741 https://access.redhat.com/errata/RHSA-2023:7741