SB2022041315 - Privilege escalation in Grafana 

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2022041315

SB2022041315 - Privilege escalation in Grafana

Published: April 13, 2022

Security Bulletin ID SB2022041315
Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2022-24812)

The vulnerability allows a remote attacker to escalate privileges on the system.

The vulnerability exists due to a design error related to caching of API keys and privilege management. When fine-grained access control is enabled and a client uses Grafana API Key to make requests, the permissions for that API Key are cached for 30 seconds for the given organization. Because of the way the cache ID is constructed, the consequent requests with any API Key evaluate to the same permissions as the previous requests.

As a result, if the first request is made with Admin permissions, and the second request with different API Key is made with Viewer permissions, the second request will get the cached permissions from the previous Admin request, resulting in privilege escalation.


Remediation

Install update from vendor's website.

References