QID 730833

Date Published: 2023-06-26

QID 730833: Grafana Authentication Bypass Vulnerability

Grafana is a multi-platform open source analytics and interactive visualization web application. It provides charts, graphs, and alerts for the web when connected to supported data sources.

This vulnerability in Grafana's system is caused by how it verifies user accounts. When Grafana is connected to Azure Active Directory (Azure AD) OAuth, it checks the user's email to validate their account. However, the issue arises because the email field in user profiles is not unique across different Azure AD tenants. This means that someone from one Azure AD tenant can pretend to be someone from another tenant by using the same email address. This creates a security problem as impersonation becomes possible due to the lack of uniqueness in email addresses across Azure AD tenants.

Affected Versions:
All installations for Grafana versions >= 6.7.0

QID Detection Logic (Unauthenticated):
This QID sends an HTTP GET request and retrieves a vulnerable version of a Grafana running on the target application.

If exploited, the attacker can gain complete control of a user's account, including access to private customer data and sensitive information. All users in Grafana deployments with Azure AD OAuth configured with a multi-tenant Azure app and that do not have allowed_groups configured are affected and can be compromised.

  • CVSS V3 rated as Critical - 9.8 severity.
  • CVSS V2 rated as Critical - 9.4 severity.
    • Solution
    Grafana has released patch addressing the issue. For more information please refer to Grafana Security Advisory

    Vendor References

    CVEs related to QID 730833

    CVE-2023-3128 |
    Software Advisories
    Advisory ID Software Component Link
    Grafana Security Advisory URL Logo grafana.com/blog/2023/06/22/grafana-security-release-for-cve-2023-3128/
    By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].