Connect with us
X
Categories:

Technology

Grafana patches vulnerability that could lead to admin account takeover

Published

on

Grafana patches vulnerability that could lead to admin account takeover
Share this post:

Open source analytics platform fixes bug that could lead to authentication bypass, privilege escalation.

Malicious actors could take over an administrator account in Grafana due to a vulnerability in its OAuth login function, researchers have warned.

The security flaw, tracked as CVE-2022-31107, could allow an attacker to access another user’s account on the open source analytics platform.

Discovered by a team of researchers from HTTPVoid, the bug, which resides in the platform’s login function, “opens the door for attackers to elevate their privileges through cross-origin attacks against administrators on systems running vulnerable versions of the open source platform”.

An attacker could therefore potentially gain access to an admin account.

Prerequisites

OAuth login is an authentication protocol that allows a user to approve one application interacting with another on their behalf without giving away the password, for example using a user’s Facebook account to log in to another app.

The attack does require some prerequisites, for example the attacker would have to have authorization to log into a Grafana instance via a configured OAuth IdP which provides a login name to take over the account of another user in that Grafana instance.

This can occur when:

  • The malicious user is authorized to log in to Grafana via OAuth
  • The malicious user’s external user ID is not already associated with an account in Grafana
  • The malicious user’s email address is not already associated with an account in Grafana
  • And the malicious user knows the Grafana username of the target user.

“If these conditions are met, the malicious user can set their username in the OAuth provider to that of the target user, then go through the OAuth flow to log in to Grafana,” a vulnerability report reads.

“Due to the way that external and internal user accounts are linked together during login, if the conditions above are all met then the malicious user will be able to log in to the target user’s Grafana account.”

RECOMMENDED  Your daily horoscope for Monday, December 5, 2022

Patch available

Speaking to The Daily Swig, Harsh Jaiswal, a member of the research team, said: “This was found while auditing source code of Grafana, the finding itself wasn’t hard but reaching to the code flow definitely took some time.

“Exploitation depends on configuration. I’d say it is moderately difficult.”

Jaiswal said that the disclosure process was positive, adding that the Grafana team was “quick in triage and the overall process was smooth”.

“Depending on the configuration, this vulnerability on exploitation could cause an authentication bypass or a privilege escalation,” the researcher warned.

The vulnerability, which is present in versions 5.3 until 9.0.3, 8.5.9, 8.4.10, and 8.3.10, has been patched by Grafana in versions 9.0.3, 8.5.9, 8.4.10, and 8.3.10.

“As a workaround, concerned users can disable OAuth login to their Grafana instance, or ensure that all users authorized to log in via OAuth have a corresponding user account in Grafana linked to their email address,” the vulnerability report adds.


Get More Stories Like This On: Facebook: @AllNaijaEntertainment, Twitter: @AllNaijaEntertainment
General2 hours ago

Skylar Grey – Everything I Need [LYRICS]

General2 hours ago

[Music] Diddy – Dirty Money – “Coming Home” Feat. Skylar Grey

General2 hours ago

Diddy – Dirty Money – “Coming Home” Feat. Skylar Grey [LYRICS]

General2 hours ago

[Music] African China – Amen

General2 hours ago

[Music] African China – Baba God

General2 hours ago

African China – Baba God [LYRICS]

General3 hours ago

Machine Gun Kelly (MGK) “Home” Feat X Ambassadors & Bebe Rexha [LYRICS]

General3 hours ago

Passenger – Let Her Go [LYRICS]

General3 hours ago

[Music] Eminem – “No Love” Feat. Lil Wayne

General3 hours ago

Eminem – “No Love” Feat. Lil Wayne [LYRICS]

Music3 hours ago

[Music] Tatiana Manaois – Buzz Kill

General3 hours ago

Tatiana Manaois – Buzz Kill [LYRICS]

General3 hours ago

James Blunt – Goodbye My Lover [LYRICS]

General3 hours ago

Major Lazer – “Particula” Feat. Nasty C , Ice Prince, Patoranking & Jidenna [LYRICS]

General3 hours ago

James Blunt – You’re Beautiful [LYRICS]

General3 hours ago

Justin Timberlake – Mirrors [LYRICS]

General3 hours ago

[Music] Darey – “Pray For Me” feat. Soweto Gospel Choir

General3 hours ago

Eminem – “Love The Way You Lie” Feat. Rihanna [LYRICS]

General3 hours ago

Goldlink ft. Miguel – Got Friends [LYRICS]

General4 hours ago

Sia – I’m Still Here [LYRICS]

General4 hours ago

Yo Gotti ft. Nicki Minaj – Rake It Up [LYRICS]

General4 hours ago

Shane McMahon – Here Comes The Money [LYRICS]

General4 hours ago

Journey – Faithfully [LYRICS]

General4 hours ago

[Music] Journey – Faithfully

General4 hours ago

Eminem – Not Afraid [LYRICS]

General4 hours ago

[Music] Journey – Don’t Stop Believin’

General4 hours ago

Journey – Don’t Stop Believin’ [LYRICS]

General5 hours ago

21 Savage – Bank Account [LYRICS]

General5 hours ago

Demi Lovato – Sober [LYRICS]

General5 hours ago

Beyonce ft. Jay-Z – Apeshit [LYRICS]

General5 hours ago

Nasty C ft. ASAP Ferg – King [LYRICS]

General5 hours ago

Lil Wayne – Uproar [LYRICS]

Ed Sheeran
Lyrics5 hours ago

Ed Sheeran – Perfect [LYRICS]

General5 hours ago

[Music] Mo’Hits All Star – Close To You

General5 hours ago

Lil Dicky ft. Chris Brown – Freaky Friday [LYRICS]

Michael Jackson
Lyrics5 hours ago

Michael Jackson – Stranger In Moscow [LYRICS]

General5 hours ago

[Music] Celine Dion – I Drove All Night

General5 hours ago

Celine Dion – I Drove All Night [LYRICS]

General5 hours ago

Tatiana Manaois – Hey Little Lady [LYRICS]

Music6 hours ago

[Music] Tatiana Manaois – Live Better

Gnash (singer)
Music4 days ago

[Music] Gnash Ft Olivia O’Brien – I Hate you, I Love you

John Legend
Music1 day ago

[INSTRUMENTAL] John Legend – All Of Me

Alan Walker
Music5 days ago

Alan Walker – Faded [INSTRUMENTAL]

21 Savage
Music2 days ago

[Video] 21 Savage ft. Offset & Metro Boomin – Rap Saved Me

Wiz Khalifa
Music3 days ago

[Instrumental] Wiz Khalifa – See You Again ft. Charlie Puth

General6 days ago

[Music] Sapientdream – Pastlives

Salvation Ministry Choir Amen
Lyrics2 days ago

Salvation Ministry Choir – Amen [LYRICS]

General7 days ago

[Music] Don Omar – Danza Kuduro (feat. Lucenzo)

General5 days ago

[Music] The Chainsmokers – ‘Don’t Let Me Down’ Feat. Daya

General7 days ago

Ladé – Adulthood Anthem (Adulthood Na Scam) [Lyrics]

General7 days ago

[Music] Timbaland – Apologize ft. OneRepublic

Powfu (singer)
Music4 days ago

[Music] Powfu – Death Bed (Coffee for Your Head) Feat. Beabadoobee

General4 days ago

[Music] Wyclef Jean – “Sweetest Girl (Dollar Bill)” Feat. Akon, Lil Wayne, Niia

General3 days ago

[Music] Zayn Malik – Entertainer

Wiz Khalifa - See You Again ft. Charlie Puth
Music4 days ago

[Music] Wiz Khalifa – See You Again ft. Charlie Puth

Music3 days ago

[Music] Exalted Tribe (HICC) – We Dey Halla

Anna Kendrick
Music4 days ago

[Music] Anna Kendrick – Cups (Pitch Perfect’s “When I’m Gone”)

General2 hours ago

[Music] Diddy – Dirty Money – “Coming Home” Feat. Skylar Grey

General1 day ago

[Music] John Legend – Love Me Now

Right Said Fred
Music4 days ago

[Music] Right Said Fred – Stand Up (For the Champions)

Salvation Ministries Mass Choir
Music1 day ago

[Music] Salvation Ministries Choir – Chioma Me Eh(Good God)

General7 hours ago

[Music] Celine Dion – If That’s What It Takes

Salvation Ministries Mass Choir
Lyrics1 day ago

Salvation Ministries Choir – Chioma Me Eh(Good God) [LYRICS]

General8 hours ago

[Music] P!nk – Try

General6 days ago

[Music] Shaggy – Strength Of A Woman

General1 day ago

[Music] Jaden Smith – Goku

Music3 days ago

[Music] Wiz Khalifa – See You Again (Remix) Feat Charlie Puth, Eminem, Tyga, & Chris Brown

R. Kelly
Music4 days ago

[Music] R. Kelly – World’s Greatest

General1 day ago

Magic! — Rude [LYRICS]

General4 hours ago

[Music] Journey – Don’t Stop Believin’

General6 days ago

[Music] Justin Bieber – Love Me

General2 days ago

[Music] Cardi B – Bartier Cardi ft. 21 Savage

General7 days ago

[Music] Lionel Richie – Angel

General3 days ago

[Music] Tyga ft. Offset – Taste

General8 hours ago

[Music] P!nk – “Just Give Me A Reason” Feat. Nate Ruess

General6 days ago

[Music] BIG SHAQ – Man’s Not Hot

General2 days ago

[Music] 21 Savage ft. Offset & Metro Boomin – Rap Saved Me

General7 days ago

[Music] Shayne Ward – Breathless

General6 days ago

[Music] Post Malone – Candy Paint

General5 days ago

[Music] R Kelly – When A Woman Loves

ANE Billboard Hots



Join "ANE sabi" clique

Don't miss a thing, get ogbonge ANE latest updates to fuel your conversation daily.