Auth proxy allows to authenticate a user by only providing the username (or email) in an X-WEBAUTH-USER HTTP header: the trust assumption is that a front proxy will take care of authentication and that the Grafana server is publicly reachable only with this front proxy. Datasource proxy breaks this assumption: - It is possible to configure a fake datasource pointing to a localhost Grafana install with an X-WEBAUTH-USER HTTP header containing the admin username - This fake datasource can be called publicly via this proxying feature
Created grafana tracking bugs for this issue: Affects: fedora-all [bug 2128565]
This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2023:2167 https://access.redhat.com/errata/RHSA-2023:2167
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2022-35957
This issue has been addressed in the following products: Red Hat Ceph Storage 6.1 Via RHSA-2023:3642 https://access.redhat.com/errata/RHSA-2023:3642