Cloudanix VulnDB

CVE-2024-1442

Medium · 6.0

CVSS

6.0

EPSS

0.8%

Published

Mar 7, 2024

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A user allowed to add new data connections can secretly gain full control over every data connection in the system, letting them view or change information they should not access.

Exploitation
Remote Authenticated
Attacker needs
High Privilege
Complexity
Low
Impact
Data Exposure
Component
Application
Class
Authorization Bypass
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Authorization bypass that allows a data source creation permission holder to create a data source with UID set to * and thereby obtain read, query, edit, and delete rights over every data source in the organization.

Why it matters to the business

An insider or compromised account with limited data-source privileges can exfiltrate, alter, or destroy data from all connected sources, increasing breach risk and operational disruption across the Grafana deployment.

How an attack unfolds

An attacker who already possesses the create-data-source permission calls the Grafana data-source creation API, supplies a UID value of *, and receives unrestricted access to every data source; no further authentication or special headers are required.

How to fix it

Upgrade Grafana to the commit d2bfe3cc0bfb304d82548c94b6d4e348ec40005e or later; after upgrade, audit existing data sources for any UID equal to * and remove them.

How to confirm the fix worked

Confirm the running binary or container image contains commit d2bfe3cc0bfb304d82548c94b6d4e348ec40005e; attempt to create a data source with UID * and verify the request is rejected with an authorization error.

Typical attack path

  1. Obtain or compromise an account that has permission to create data sources
  2. Issue a POST /api/datasources request with a JSON body containing "uid":"*"
  3. Receive 200 OK confirming creation of the wildcard data source
  4. Use the returned credentials or session to perform read, query, edit, or delete operations against any data source UID

How to detect it

Search Grafana server logs for data-source creation requests that contain the literal UID value *; correlate with the creating user identity and subsequent access to other data-source UIDs.

What your security team should do

  • Apply the fixed commit immediately on all Grafana instances
  • Review and tighten data-source creation permissions to the minimum necessary users
  • Enable audit logging for data-source API calls and retain logs for at least 90 days
  • Scan existing data sources for UID values of * and delete any found

The record

A user with the permissions to create a data source can use Grafana API to create a data source with UID set to *. Doing this will grant the user access to read, query, edit and delete all data sources within the organization.

Affected packages

Ecosystem Package Introduced Fixed
Go github.com/grafana/grafana 0 No fix
Go github.com/grafana/grafana 10.0.0 10.0.12
Go github.com/grafana/grafana 10.1.0 10.1.8
Go github.com/grafana/grafana 10.2.0 10.2.5
Go github.com/grafana/grafana 10.3.0 10.3.4
Go github.com/grafana/grafana 8.5.0 9.5.7
Bitnami grafana 8.5.0 9.5.7
Chainguard grafana 0 10.4.0-r0
Chainguard grafana-dashboards 0 10.4.0-r0
Chainguard grafana-homepage 0 10.4.0-r0
Ubuntu:16.04:LTS grafana 0 No fix
Ubuntu:Pro:16.04:LTS grafana 0 No fix
Wolfi grafana 0 10.4.0-r0
go github.com/grafana/grafana 10.0.0 10.0.12
go github.com/grafana/grafana 10.1.0 10.1.8
go github.com/grafana/grafana 10.2.0 10.2.5
go github.com/grafana/grafana 10.3.0 10.3.4
go github.com/grafana/grafana 8.5.0 9.5.7

Related vulnerabilities