GHSA-mpv3-g8m3-3fjc

Grafana vulnerable to Authentication Bypass by Spoofing

Source: GitHub Advisory Database (reviewed) Critical CVE-2023-3128

Packages

Ecosystem	Package	Affected	Fixed in
Go	github.com/grafana/grafana	>= 9.4.0, < 9.4.13	9.4.13
Go	github.com/grafana/grafana	>= 9.3.0, < 9.3.16	9.3.16
Go	github.com/grafana/grafana	>= 9.0.0, < 9.2.20	9.2.20
Go	github.com/grafana/grafana	< 8.5.27	8.5.27

Details

As written in the advisory (Markdown source, shown as plain text).

Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique and can be easily modified. This leads to account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant app.

References

External links from the advisory. They lead to third-party sites.

https://github.com/grafana/bugbounty/security/advisories/GHSA-gxh2-6vvc-rrgp web
https://nvd.nist.gov/vuln/detail/CVE-2023-3128 advisory
https://github.com/grafana/grafana package
https://github.com/grafana/grafana/blob/69fc4e6bc0be2a82085ab3885c2262a4d49e97d8/CHANGELOG.md web
https://grafana.com/security/security-advisories/cve-2023-3128 web
https://security.netapp.com/advisory/ntap-20230714-0004 web