CVE-2022-31107 Grafana is an open-source platform for monitoring and observability

CVE-2022-31107 Grafana is an open-source platform for monitoring and observability

as that user. This allows the malicious user to gain access to all of the Grafana data for the target user's account and see that user's dashboards and data, even if that data is marked as private. This issue does not affect access to the Grafana web user interface and does not allow the malicious user to send data to external systems. It is only possible to perform this attack if the user has authorized the malicious user to access the OAuth IdP. This issue has been fixed in version 9.0.4. If a user is using an OAuth IdP that is not configured with the email address of the Grafana server, and the user's external user id is not already associated with an account in the Grafana server, the user will have to log in to the Grafana server via that OAuth IdP and their external user id, then log in to the Grafana server using their configured username and password. This issue does not affect access to the Grafana web user interface or the ability for the malicious user to send data to external systems. It is only possible to perform this attack if the user has authorized the malicious user to access the OAuth IdP.

CVE-2022-31108

If the malicious user has already logged in to the Grafana server via an authorized OAuth IdP and they have access to the data of other users, they can alter that data. For example, if the malicious user only has access to the data of one other user on their account, they could add a second device with a different name and connect it to their account. This issue does not affect access to the Grafana web user interface or the ability for the malicious user to send data to external systems. It is only possible to perform this attack if the user has authorized the malicious user to access an OAuth IdP that is not configured with email address of Grafana server.

References

- https://www.grafanadotcom/blog/CVE-2022-31107
- https://support.grafanadotcom/hc/en-us/articles/36000177697

Users must authorize the malicious user to access their OAuth IdP

The malicious user must have authorization from the target user to access their OAuth IdP.

Summary

A flaw in the Grafana front-end allowed a malicious user to gain access to all of the Grafana data for the target user's account and see that user's dashboards and data, even if that data is marked as private. This issue does not affect access to the Grafana web user interface or send data to external systems. It only affects if a user is using an OAuth IdP that is not configured with the email address of the Grafana server. If a user's external user id is not already associated with an account in the Grafana server, they will have to log in to the Grafana server via that OAuth IdP and their external user id, then log in using their configured username and password.

References

Subscribe to CVE.news
Don’t miss out on the latest issues. Sign up now to get access to the library of members-only issues.
jamie@example.com
Subscribe