CVE-2021-41174: Grafana Arbitrary JavaScript Execution
Summary
CVE-2021-41174: XSS vulnerability allowing arbitrary JavaScript execution. Affects grafana versions >= 8.0.0, < 8.2.3. Fixed in 8.2.3. How to fix ↓
Also tracked for
- @grafana/data · npm
The same CVE-2021-41174 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Grafana is an open-source platform used for monitoring and observability. It provides various features for data visualization, analytics, and alerting. This vulnerability affects Grafana versions prior to 8.2.3. The vulnerability allows an attacker to execute arbitrary JavaScript code within the victim's browser by tricking them into visiting a specially crafted URL. The vulnerability occurs due to improper validation of user input and the use of AngularJS rendering engine.
Vulnerability Detail
The vulnerability arises when an unauthenticated user visits a malicious URL that references a vulnerable page containing the login button. The URL must be crafted to exploit AngularJS rendering and include an AngularJS expression within double curly braces. When the page renders, the login button will contain the original link with a query parameter to force a redirect to the login page. The URL is not properly validated, allowing the execution of the JavaScript expression contained in the URL. This can lead to various attacks, such as cross-site scripting (XSS) and data theft.
How To Fix
Minimum fixed version
8.2.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
To mitigate the vulnerability, you can configure a reverse proxy to block URLs containing '{{' in the path. Here is an example configuration for Nginx:
location ~* /{{ {
return 403;
}
This configuration will return a 403 Forbidden response for any URL containing '{{' in the path.
Conclusion
The CVE-2021-41174 vulnerability in Grafana allows for arbitrary JavaScript execution within the victim's browser. It is crucial to upgrade to Grafana version 8.2.3 or later to mitigate this vulnerability. If upgrading is not feasible, implementing a reverse proxy to block URLs containing '{{' in the path can provide a temporary workaround. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for grafana →
FAQ
Grafana is an open-source platform used for monitoring and observability. It provides features for data visualization, analytics, and alerting.
Versions of Grafana prior to 8.2.3 are affected by this vulnerability.
An attacker can exploit this vulnerability by tricking an unauthenticated user into visiting a specially crafted URL that contains an AngularJS expression within double curly braces.
This vulnerability can lead to arbitrary JavaScript code execution within the victim's browser. This can enable various attacks, such as cross-site scripting (XSS) and data theft.
Yes, a workaround is to use a reverse proxy or similar solution to block access to URLs containing the literal string '{{' in the path.
References
Related vulnerabilities
Recent vulnerabilities recorded for grafana.
