Описание
We have released version 5.24.0 of the Grafana Operator. This patch includes a MEDIUM severity security fix for a path traversal/privilege escalation vulnerability in the Grafana Operator.
Summary
The Grafana Operator supports loading dashboards & library panels using the jsonnet data templating language. The jsonnet expression is evaluated in the context of the operator manager pod.
Impact
It is possible for a malicious user who can create Dashboard or LibraryPanel resources for a Grafana instance to obtain the Kubernetes service account token of the Grafana Operator manager.
Affected versions
All Grafana Operator versions <= 5.23
Solutions and mitigations
All installations should be upgraded as soon as possible. As a workaround, the following ValidatingAdmissionPolicy prevent the creation or modification of jsonnet based resources: apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingAdmissionPolicy metadata: name: "prevent-jsonnet-dashboards" spec: failurePolicy: Fail matchConstraints: resourceRules:
- apiGroups: ["grafana.integreatly.org"] apiVersions: ["v1beta1"] operations: ["CREATE", "UPDATE"] resources: ["grafanadashboards", "grafanalibrarypanels"] validations:
- expression: "!has(object.spec.jsonnetLib)"
apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingAdmissionPolicyBinding metadata: name: "prevent-jsonnet-dashboards-clusterwide" spec: policyName: "prevent-jsonnet-dashboards" validationActions: [Deny]
Acknowledgement
We would like to thank Artem Cherezov for responsibly disclosing the vulnerability.
A flaw was found in the Grafana Operator. This vulnerability allows a malicious user, who can create Dashboard or LibraryPanel resources for a Grafana instance, to exploit a path traversal issue within the jsonnet data templating language. This exploitation can lead to privilege escalation and information disclosure, specifically enabling the attacker to obtain the Kubernetes service account token of the Grafana Operator manager.
Отчет
Red Hat rates this flaw as Moderate severity, in alignment with the upstream Grafana project's assessment. Per Red Hat's severity rating guidelines (https://access.redhat.com/security/updates/classification), Critical impact requires a flaw that could be easily exploited by a remote unauthenticated attacker. This vulnerability requires Kubernetes RBAC privileges to create or modify Dashboard or LibraryPanel custom resources, and therefore cannot be exploited without prior authentication. The direct impact is limited to disclosure of the Grafana Operator manager's service account token through path traversal in jsonnet templating; actual exploitability depends on the specific RBAC configuration and permissions granted to the operator's service account in a given deployment.
Меры по смягчению последствий
To mitigate this issue, implement a ValidatingAdmissionPolicy to prevent the creation or modification of jsonnet-based Dashboard or LibraryPanel resources. This policy restricts the attack surface by disallowing the use of the vulnerable jsonnet templating feature. Example ValidatingAdmissionPolicy:
Example ValidatingAdmissionPolicyBinding:
Applying these policies will prevent new or updated resources from using the vulnerable jsonnet feature. No service restart is typically required for ValidatingAdmissionPolicies to take effect, but their impact on resource creation/update operations should be monitored.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat 3scale API Management Platform 2 | 3scale-amp2/3scale-operator-bundle | Not affected | ||
| Red Hat 3scale API Management Platform 2 | 3scale-amp2/3scale-rhel7-operator | Not affected | ||
| Red Hat 3scale API Management Platform 2 | 3scale-amp2/3scale-rhel9-operator | Not affected | ||
| Red Hat OpenShift distributed tracing 3 | rhosdt/tempo-rhel9-operator | Not affected |
Показывать по
Дополнительная информация
Статус:
6.4 Medium
CVSS3
Связанные уязвимости
We have released version 5.24.0 of the Grafana Operator. This patch includes a MEDIUM severity security fix for a path traversal/privilege escalation vulnerability in the Grafana Operator. ### Summary The Grafana Operator supports loading dashboards & library panels using the jsonnet data templating language. The jsonnet expression is evaluated in the context of the operator manager pod. ### Impact It is possible for a malicious user who can create Dashboard or LibraryPanel resources for a Grafana instance to obtain the Kubernetes service account token of the Grafana Operator manager. ### Affected versions All Grafana Operator versions <= 5.23 ### Solutions and mitigations All installations should be upgraded as soon as possible. As a workaround, the following ValidatingAdmissionPolicy prevent the creation or modification of jsonnet based resources: apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingAdmissionPolicy metadata: name: "prevent-jsonnet-dashboards" spe
Grafana Operator: Privilege escalation from namespace admin to cluster admin via GrafanaDashboard jsonnetLib fileName
6.4 Medium
CVSS3