CVE-2023-5123
Improper Path Sanitization in JSON Datasource Plugin
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
The JSON datasource plugin ( https://grafana.com/grafana/plugins/marcusolsson-json-datasource/ ) is a Grafana Labs maintained plugin for Grafana that allows for retrieving and processing JSON data from a remote endpoint (including a specific sub-path) configured by an administrator. Due to inadequate sanitization of the dashboard-supplied path parameter, it was possible to include path traversal characters (../) in the path parameter and send requests to paths on the configured endpoint outside the configured sub-path.
This means that if the datasource was configured by an administrator to point at some sub-path of a domain (e.g. https://example.com/api/some_safe_api/ ), it was possible for an editor to create a dashboard referencing the datasource which issues queries containing path traversal characters, which would in turn cause the datasource to instead query arbitrary subpaths on the configured domain (e.g. https://example.com/api/admin_api/) .
In the rare case that this plugin is configured by an administrator to point back at the Grafana instance itself, this vulnerability becomes considerably more severe, as an administrator browsing a maliciously configured panel could be compelled to make requests to Grafana administrative API endpoints with their credentials, resulting in the potential for privilege escalation, hence the high score for this vulnerability.
El complemento de fuente de datos JSON (https://grafana.com/grafana/plugins/marcusolsson-json-datasource/ https://grafana.com/grafana/plugins/marcusolsson-json-datasource/) es un complemento mantenido por Grafana Labs para Grafana que permite recuperar y procesar datos JSON desde un endpoint remoto (incluida una subruta específica) configurado por un administrador. Debido a una sanitización inadecuada del parámetro de ruta proporcionado por el panel, fue posible incluir caracteres de path traversal (../) en el parámetro de ruta y enviar solicitudes a rutas en el endpoint configurado fuera de la subruta configurada. Esto significa que si un administrador configuró la fuente de datos para que apunte a alguna subruta de un dominio (por ejemplo, https://example.com/api/some_safe_api/ https://example.com/api/some_safe_api/), Era posible que un editor creara un panel que hiciera referencia a la fuente de datos y que emitiera consultas que contuvieran caracteres de path traversal, lo que a su vez causaría que la fuente de datos consultara subrutas arbitrarias en el dominio configurado (por ejemplo, https://example.com/api/admin_api/ ) https://example.com/api/admin_api/). En el raro caso de que un administrador configure este complemento para apuntar a la propia instancia de Grafana, esta vulnerabilidad se vuelve considerablemente más grave, ya que un administrador que navega por un panel configurado maliciosamente podría verse obligado a realizar solicitudes a los endpoints de la API administrativa de Grafana con sus credenciales, lo que genera la posibilidad de una escalada de privilegios, de ahí la puntuación alta para esta vulnerabilidad.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2023-09-22 CVE Reserved
- 2024-02-14 CVE Published
- 2024-02-15 EPSS Updated
- 2024-08-02 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CAPEC
- CAPEC-126: Path Traversal
References (2)
| URL | Tag | Source |
|---|---|---|
| https://grafana.com/security/security-advisories/cve-2023-5123 | ||
| https://security.netapp.com/advisory/ntap-20240503-0007 |
|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Grafana Search vendor "Grafana" | Grafana-json-datasource Search vendor "Grafana" for product "Grafana-json-datasource" | >= 0.2.0 < 1.3.16 Search vendor "Grafana" for product "Grafana-json-datasource" and version " >= 0.2.0 < 1.3.16" | en |
Affected
| ||||||