cve-2023-5123
Vulnerability from cvelistv5
Published
2024-02-14 15:06
Modified
2024-08-02 07:44
Severity ?
8.0 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Summary
Improper Path Sanitization in JSON Datasource Plugin
References
security@grafana.comhttps://grafana.com/security/security-advisories/cve-2023-5123/
security@grafana.comhttps://security.netapp.com/advisory/ntap-20240503-0007/
Impacted products
Grafanagrafana-json-datasource
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T07:44:53.814Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://grafana.com/security/security-advisories/cve-2023-5123/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240503-0007/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "grafana-json-datasource",
          "repo": "https://github.com/grafana/grafana-json-datasource",
          "vendor": "Grafana",
          "versions": [
            {
              "lessThan": "1.3.16",
              "status": "affected",
              "version": "0.2.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "To be exposed to the full risk of this vulnerability, an administrator must have installed this plugin and configured it to send requests back to the Grafana API, with a subpath constraint set to prevent requests to administrative API endpoints.\u003cbr\u003e"
            }
          ],
          "value": "To be exposed to the full risk of this vulnerability, an administrator must have installed this plugin and configured it to send requests back to the Grafana API, with a subpath constraint set to prevent requests to administrative API endpoints."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003ctable\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003eThe JSON datasource plugin (\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://grafana.com/grafana/plugins/marcusolsson-json-datasource/\"\u003ehttps://grafana.com/grafana/plugins/marcusolsson-json-datasource/\u003c/a\u003e) is a Grafana Labs maintained plugin for Grafana that allows for retrieving and processing JSON data from a remote endpoint (including a specific sub-path) configured by an administrator. Due to inadequate sanitization of the dashboard-supplied path parameter, it was possible to include path traversal characters (../) in the path parameter and send requests to paths on the configured endpoint outside the configured sub-path. \u003c/td\u003e\n\u003c/tr\u003e\n\n\n\n\n    \u003ctr\u003e\n    \u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\n        \u003ctable\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003e    \u003cbr\u003e\u003c/td\u003e\n\u003c/tr\u003e\n\n\n\n\n    \u003ctr\u003e\n    \u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\n            This means that if the datasource was configured by an administrator to point at some sub-path of a domain (e.g. \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://example.com/api/some_safe_api/\"\u003ehttps://example.com/api/some_safe_api/\u003c/a\u003e), it was possible for an editor to create a dashboard referencing the datasource which issues queries containing path traversal characters, which would in turn cause the datasource to instead query arbitrary subpaths on the configured domain (e.g. \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://example.com/api/admin_api/)\"\u003ehttps://example.com/api/admin_api/)\u003c/a\u003e.\u003cbr\u003e\u003cbr\u003eIn the rare case that this plugin is configured by an administrator to point back at the Grafana instance itself, this vulnerability becomes considerably more severe, as an administrator browsing a maliciously configured panel could be compelled to make requests to Grafana administrative API endpoints with their credentials, resulting in the potential for privilege escalation, hence the high score for this vulnerability.\u003cbr\u003e"
            }
          ],
          "value": "The JSON datasource plugin ( https://grafana.com/grafana/plugins/marcusolsson-json-datasource/ ) is a Grafana Labs maintained plugin for Grafana that allows for retrieving and processing JSON data from a remote endpoint (including a specific sub-path) configured by an administrator. Due to inadequate sanitization of the dashboard-supplied path parameter, it was possible to include path traversal characters (../) in the path parameter and send requests to paths on the configured endpoint outside the configured sub-path. \n\n\n\n\n\n    \n    \n            \n\n\n\n\n\n\n    \n    \n            This means that if the datasource was configured by an administrator to point at some sub-path of a domain (e.g.  https://example.com/api/some_safe_api/ ), it was possible for an editor to create a dashboard referencing the datasource which issues queries containing path traversal characters, which would in turn cause the datasource to instead query arbitrary subpaths on the configured domain (e.g.  https://example.com/api/admin_api/) .\n\nIn the rare case that this plugin is configured by an administrator to point back at the Grafana instance itself, this vulnerability becomes considerably more severe, as an administrator browsing a maliciously configured panel could be compelled to make requests to Grafana administrative API endpoints with their credentials, resulting in the potential for privilege escalation, hence the high score for this vulnerability."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-126",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-126 Path Traversal"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-18T09:26:49.158Z",
        "orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
        "shortName": "GRAFANA"
      },
      "references": [
        {
          "url": "https://grafana.com/security/security-advisories/cve-2023-5123/"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20240503-0007/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Improper Path Sanitization in JSON Datasource Plugin",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
    "assignerShortName": "GRAFANA",
    "cveId": "CVE-2023-5123",
    "datePublished": "2024-02-14T15:06:11.126Z",
    "dateReserved": "2023-09-22T14:37:00.387Z",
    "dateUpdated": "2024-08-02T07:44:53.814Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-5123\",\"sourceIdentifier\":\"security@grafana.com\",\"published\":\"2024-02-14T15:15:08.620\",\"lastModified\":\"2024-06-18T10:15:09.937\",\"vulnStatus\":\"Awaiting Analysis\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"The JSON datasource plugin ( https://grafana.com/grafana/plugins/marcusolsson-json-datasource/ ) is a Grafana Labs maintained plugin for Grafana that allows for retrieving and processing JSON data from a remote endpoint (including a specific sub-path) configured by an administrator. Due to inadequate sanitization of the dashboard-supplied path parameter, it was possible to include path traversal characters (../) in the path parameter and send requests to paths on the configured endpoint outside the configured sub-path. \\n\\n\\n\\n\\n\\n    \\n    \\n            \\n\\n\\n\\n\\n\\n\\n    \\n    \\n            This means that if the datasource was configured by an administrator to point at some sub-path of a domain (e.g.  https://example.com/api/some_safe_api/ ), it was possible for an editor to create a dashboard referencing the datasource which issues queries containing path traversal characters, which would in turn cause the datasource to instead query arbitrary subpaths on the configured domain (e.g.  https://example.com/api/admin_api/) .\\n\\nIn the rare case that this plugin is configured by an administrator to point back at the Grafana instance itself, this vulnerability becomes considerably more severe, as an administrator browsing a maliciously configured panel could be compelled to make requests to Grafana administrative API endpoints with their credentials, resulting in the potential for privilege escalation, hence the high score for this vulnerability.\"},{\"lang\":\"es\",\"value\":\"El complemento de fuente de datos JSON (https://grafana.com/grafana/plugins/marcusolsson-json-datasource/ https://grafana.com/grafana/plugins/marcusolsson-json-datasource/) es un complemento mantenido por Grafana Labs para Grafana que permite recuperar y procesar datos JSON desde un endpoint remoto (incluida una subruta espec\u00edfica) configurado por un administrador. Debido a una sanitizaci\u00f3n inadecuada del par\u00e1metro de ruta proporcionado por el panel, fue posible incluir caracteres de path traversal (../) en el par\u00e1metro de ruta y enviar solicitudes a rutas en el endpoint configurado fuera de la subruta configurada. Esto significa que si un administrador configur\u00f3 la fuente de datos para que apunte a alguna subruta de un dominio (por ejemplo, https://example.com/api/some_safe_api/ https://example.com/api/some_safe_api/), Era posible que un editor creara un panel que hiciera referencia a la fuente de datos y que emitiera consultas que contuvieran caracteres de path traversal, lo que a su vez causar\u00eda que la fuente de datos consultara subrutas arbitrarias en el dominio configurado (por ejemplo, https://example.com/api/admin_api/ ) https://example.com/api/admin_api/). En el raro caso de que un administrador configure este complemento para apuntar a la propia instancia de Grafana, esta vulnerabilidad se vuelve considerablemente m\u00e1s grave, ya que un administrador que navega por un panel configurado maliciosamente podr\u00eda verse obligado a realizar solicitudes a los endpoints de la API administrativa de Grafana con sus credenciales, lo que genera la posibilidad de una escalada de privilegios, de ah\u00ed la puntuaci\u00f3n alta para esta vulnerabilidad.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security@grafana.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\",\"baseScore\":8.0,\"baseSeverity\":\"HIGH\"},\"exploitabilityScore\":2.1,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"security@grafana.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-22\"}]}],\"references\":[{\"url\":\"https://grafana.com/security/security-advisories/cve-2023-5123/\",\"source\":\"security@grafana.com\"},{\"url\":\"https://security.netapp.com/advisory/ntap-20240503-0007/\",\"source\":\"security@grafana.com\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.