A new security vulnerability has been found in the Grafana open-source platform (CVE-2023-2183), which could enable a malicious user with a limited "Viewer" role to send test alerts through the API, bypassing the Graphana user interface (UI) restrictions set on their account. This could potentially result in abuse of the alert system, spamming users with alert messages via email and Slack or preparing a Phishing attack. In the worst-case scenario, a malicious actor could exploit this vulnerability to flood or block an organization's SMTP server.
The Grafana team has already addressed this issue by releasing patches in versions 9.5.3, 9.4.12, 9.3.15, 9.2.19, and 8.5.26.
Exploit Details
The vulnerability occurs because the Grafana API does not properly check access to the test Alert function for users with a "Viewer" role, allowing them to bypass the user interface's restrictions. By utilizing the API, a user with limited access can send test alerts to any configured alert targets, such as email or Slack.
The following code snippet illustrates a possible API request to send a test alert using the Grafana API:
import requests
URL = "https://your-grafana-instance.com/api/alerts/test";
HEADERS = {"Authorization": "Bearer YOUR_API_KEY", "Content-Type": "application/json"}
DATA = {"dashboardId": 1, "panelId": 1, "message": "Test Alert"}
response = requests.post(URL, headers=HEADERS, json=DATA)
print(response.status_code)
Replace "your-grafana-instance.com" with your actual Grafana domain and "YOUR_API_KEY" with the appropriate API key for the account.
Original References
You can read more about this issue and the related CVE on the official Grafana GitHub repository, where the vulnerability was first reported and fixed:
- GitHub Issue: Unauthorized Test Alert API Usage
- GitHub PR: Restrict Test Alert API Usage
Mitigation Steps
Grafana users are strongly recommended to upgrade their installations to the latest patched versions. The following versions include the fix for the vulnerability:
Grafana 8.5.26
You can download the updated releases at the official Grafana download page.
Conclusion
CVE-2023-2183 is a crucial vulnerability in Grafana that allows users with limited "Viewer" role access to send test alerts with the API, bypassing user interface restrictions. To protect your Grafana installation from potential abuse or phishing attacks, apply the available patches in the latest versions immediately. Additionally, Grafana administrators should keep monitoring the official channels and consider following best practices for securing their Grafana installations.
Timeline
Published on: 06/06/2023 19:15:00 UTC
Last modified on: 06/13/2023 16:30:00 UTC