GO-2024-2867: Grafana vulnerable to spoofing originalUrl of snapshots

Q: Who can exploit this issue?

A malicious user who can create a Grafana snapshot can exploit it by editing the snapshot query to supply an arbitrary originalUrl value. Exploitation also requires another user to open the crafted snapshot and interact with the “Open original dashboard” button.

Q: What is the practical impact on a user opening a crafted snapshot?

The snapshot initially presents the normal Grafana web interface from the trusted server, but its “Open original dashboard” button points to an attacker-controlled URL rather than the genuine source dashboard. This can make the attacker-controlled destination appear more trustworthy to the user.

Q: Which versions address the issue?

The issue is fixed in Grafana versions 8.5.16 and 9.2.8. Versions prior to those releases are affected according to the provided advisory.

Published Jan 27, 2023

Updated

Grafana is an open-source platform for monitoring and observability. Prior to versions 8.5.16 and 9.2.8, malicious user can create a snapshot and arbitrarily choose the originalUrl parameter by editing the query, thanks to a web proxy. When another user opens the URL of the snapshot, they will be presented with the regular web interface delivered by the trusted Grafana server. The Open original dashboard button no longer points to the to the real original dashboard but to the attacker’s injected URL. This issue is fixed in versions 8.5.16 and 9.2.8.

Affected Software

1 affected component

Grafana Grafana<8.5.16, <9.2.8

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Grafana to a version that resolves this vulnerability.
Fixed in 8.5.16
Upgrade
Upgrade Grafana to a version that resolves this vulnerability.
Fixed in 9.2.8

Event History

Jan 27, 2023

CVE Published

via OSV·10:42 PM

Data Sourced

via OSV·10:42 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

A malicious user who can create a Grafana snapshot can exploit it by editing the snapshot query to supply an arbitrary originalUrl value. Exploitation also requires another user to open the crafted snapshot and interact with the “Open original dashboard” button.

What is the practical impact on a user opening a crafted snapshot?

The snapshot initially presents the normal Grafana web interface from the trusted server, but its “Open original dashboard” button points to an attacker-controlled URL rather than the genuine source dashboard. This can make the attacker-controlled destination appear more trustworthy to the user.

Which versions address the issue?

The issue is fixed in Grafana versions 8.5.16 and 9.2.8. Versions prior to those releases are affected according to the provided advisory.

GO-2024-2867: Grafana vulnerable to spoofing originalUrl of snapshots

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What is the practical impact on a user opening a crafted snapshot?

Which versions address the issue?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What is the practical impact on a user opening a crafted snapshot?

Which versions address the issue?