GHSA-cjgj-2fwf-4c2w: Go/github.com/perses/perses vulnerability
Impact What kind of vulnerability is it?
An authenticated user who is only a viewer on project team-a requests GET /api/v1/projects/team-a/dashboards?project=finance-secret (or simply GET /api/v1/datasources?project=finance-secret) and receives the full list of the finance-secret project's dashboards and datasource specifications, despite having no role on that project. This defeats Perses' project-level tenant isolation for all project-scoped read resources.
Who is impacted?
Any authenticated user reads every project's dashboards, datasources, variables across tenants.
Patches Has the problem been patched? What versions should users upgrade to?
Workarounds None
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/perses/persesto a version that resolves this vulnerability.Fixed in 0.54.0-beta.3
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated user can exploit it, including users who have only viewer access to an unrelated project. No role on the target project is required.
What information can an unauthorized user access?
An attacker can read project-scoped resources from other projects, including dashboards, datasource specifications, and variables. For example, requesting resources with another project's name returns that project's full resource list.
Are there any workarounds if an upgrade cannot be performed immediately?
No workarounds are provided.