PT-2024-3766 · Grafana+6 · Grafana+6
CVSS v4.0
7.1
High
| Vector | AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Grafana versions 9.5.0 through 9.5.17
Grafana versions 10.0.0 through 10.0.12
Grafana versions 10.1.0 through 10.1.8
Grafana versions 10.2.0 through 10.2.5
Grafana versions 10.3.0 through 10.3.4
Description
The issue is related to a Broken Object-Level Authorization (BOLA) vulnerability, which allows low-privileged users to delete dashboard snapshots belonging to other organizations using the snapshot's key. This can be done by issuing a DELETE request to the
/api/snapshots/<key> endpoint. The vulnerability is caused by a bug in the authorization logic, which treats deletion requests from unprivileged users in different organizations as authorized.Technical details about exploitation include:
- API Endpoint:
/api/snapshots/<key> - Vulnerable Parameter or Variable:
key - The attacker must know the
keyof a snapshot to exploit this vulnerability. Thekeycan be discovered in various ways, such as being displayed in plain text in the URL of a snapshot or being guessed through brute-force attacks due to a lack of complexity requirements.
Recommendations
To resolve the issue for each affected version, update to the respective fixed version or later:
- For versions 9.5.0 through 9.5.17, update to version 9.5.18 or later.
- For versions 10.0.0 through 10.0.12, update to version 10.0.13 or later.
- For versions 10.1.0 through 10.1.8, update to version 10.1.9 or later.
- For versions 10.2.0 through 10.2.5, update to version 10.2.6 or later.
- For versions 10.3.0 through 10.3.4, update to version 10.3.5 or later.
As a temporary workaround, consider restricting access to the
/api/snapshots/<key>endpoint to minimize the risk of exploitation.
Exploit
Fix
DoS
IDOR
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Almalinux
Centos
Grafana
Red Hat
Red Os
Rocky Linux
Suse