Описание
An authenticated attacker with Editor access or alert.instances.external:write can submit an external Alertmanager alert containing a controlled generatorURL. The attacker is authorized to create the alert, but not to execute script in another user's Grafana session.
Grafana renders alert.generatorURL directly as the Alert Details See source LinkButton href without URL-scheme sanitization or a safe-protocol allowlist. The click interceptor's :// heuristic can be bypassed by placing :// inside a JavaScript comment. When a user with read access clicks See source, the browser executes attacker-controlled JavaScript in the Grafana origin with the clicking user's permissions.
A flaw was found in Grafana. An authenticated attacker with Editor access or alert.instances.external:write permissions can submit an external Alertmanager alert containing a controlled generatorURL. Grafana improperly renders this URL without proper sanitization, allowing for a bypass of the click interceptor's security heuristic. This can lead to a Cross-Site Scripting (XSS) vulnerability, where a user with read access who clicks the 'See source' link will execute attacker-controlled JavaScript in their browser with the permissions of the clicking user, potentially leading to information disclosure or unauthorized actions.
Отчет
A cross-site scripting (XSS) vulnerability was found in Grafana's Alertmanager integration. An authenticated attacker with Editor access or alert.instances.external:write permissions can submit an alert containing a crafted generatorURL that bypasses URL sanitization heuristics using JavaScript comment syntax. When another user views the alert details and clicks the "See source" button, the attacker's script executes within the victim's browser session under Grafana's origin. This enables session hijacking, unauthorized API actions, and access to all dashboards and datasources visible to the victim.
Меры по смягчению последствий
Restrict alert creation and external Alertmanager submission permissions (alert.instances.external:write) to trusted administrators using Grafana RBAC. Advise operators to refrain from clicking the "See source" link on unverified external alerts.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Multicluster Global Hub | multicluster-globalhub/multicluster-globalhub-grafana-rhel9 | Fix deferred | ||
| Red Hat Advanced Cluster Management for Kubernetes 2 | rhacm2/acm-grafana-rhel9 | Fix deferred | ||
| Red Hat Ceph Storage 7 | rhceph/grafana-rhel9 | Fix deferred | ||
| Red Hat Ceph Storage 8 | rhceph/grafana-rhel9 | Not affected | ||
| Red Hat Ceph Storage 9 | rhceph/grafana-rhel10 | Fix deferred | ||
| Red Hat Enterprise Linux 10 | grafana | Fix deferred | ||
| Red Hat Enterprise Linux 10 | rhel10/grafana | Not affected | ||
| Red Hat Enterprise Linux 8 | grafana | Fix deferred | ||
| Red Hat Enterprise Linux 9 | grafana | Fix deferred | ||
| Red Hat Enterprise Linux 9 | rhel9/grafana | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
6.8 Medium
CVSS3
Связанные уязвимости
An authenticated attacker with Editor access or alert.instances.external:write can submit an external Alertmanager alert containing a controlled generatorURL. The attacker is authorized to create the alert, but not to execute script in another user's Grafana session. Grafana renders alert.generatorURL directly as the Alert Details See source LinkButton href without URL-scheme sanitization or a safe-protocol allowlist. The click interceptor's :// heuristic can be bypassed by placing :// inside a JavaScript comment. When a user with read access clicks See source, the browser executes attacker-controlled JavaScript in the Grafana origin with the clicking user's permissions.
An authenticated attacker with Editor access or alert.instances.external:write can submit an external Alertmanager alert containing a controlled generatorURL. The attacker is authorized to create the alert, but not to execute script in another user's Grafana session. Grafana renders alert.generatorURL directly as the Alert Details See source LinkButton href without URL-scheme sanitization or a safe-protocol allowlist. The click interceptor's :// heuristic can be bypassed by placing :// inside a JavaScript comment. When a user with read access clicks See source, the browser executes attacker-controlled JavaScript in the Grafana origin with the clicking user's permissions.
Уязвимость платформы для мониторинга и наблюдения Grafana, связанная с непринятием мер по защите структуры веб-страницы, позволяющая нарушителю выполнить произвольный код
EPSS
6.8 Medium
CVSS3