Bug 2544605

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

Short description of the vulnerability: 

The Geomap panel's MapLibre style base layer loads a map style from a URL and inserted that style's attribution field into the page without sanitising it. A user with only the Editor role can point the layer at a style they control and have arbitrary JavaScript run in the browser of anyone who views the dashboard. If an Org Admin opens the dashboard, the script runs in the admin's session and can raise the attacker's own account to Org Admin, giving them access to dashboards and data source configurations across the organisation, including any credentials stored in those data sources. No special configuration is required; the panel is enabled by default. 

Known mitigations: 

Update to one of the private builds listed above. Until you have updated, setting disable_plugins = geomap in the [plugins] section of grafana.ini (or the GF_PLUGINS_DISABLE_PLUGINS=geomap environment variable) and restarting Grafana removes the vulnerable panel, at the cost of breaking existing dashboards that use it. Enabling content_security_policy = true in the [security] section gives partial protection but is not a substitute for the update: it stops working once connect-src has been widened, which is common when direct-access data sources or plugins are in use. 

Affected products and versions: 
Grafana OSS and Grafana Enterprise: 12.3.0 to 12.3.11, 12.4.0 to 12.4.9, 13.0.0 to 13.0.7, 13.1.0 to 13.1.4, and 13.2.0. The earlier release of 12.2 is not affected.