CVE-2021-41174: XSS vulnerability in Grafana @grafana/data package
Summary
CVE-2021-41174: XSS vulnerability allowing arbitrary JavaScript execution. Affects @grafana/data versions >= 8.0.0, < 8.2.3. Fixed in 8.2.3. How to fix ↓
Also tracked for
- grafana · Bitnami
The same CVE-2021-41174 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @grafana/data package is a part of Grafana, an open-source analytics and monitoring platform. It provides functionality for handling and manipulating data within Grafana. The package is widely used and plays a crucial role in the overall functionality of Grafana.
Vulnerability Detail
The vulnerability identified as CVE-2021-41174 is an XSS (Cross-Site Scripting) vulnerability that affects versions of Grafana from 8.0.0-beta1 to 8.2.2. If an unauthenticated user visits a URL referencing a vulnerable page, arbitrary JavaScript code can be executed within the victim's browser. The attack requires the user to be unauthenticated and the link to be for a page containing the login button. This vulnerability can be exploited by crafting a URL with an AngularJS expression, which is executed by the AngularJS rendering engine when the page is rendered. The impact of this vulnerability includes potential data theft, session hijacking, and unauthorized access to sensitive information.
How To Fix
Minimum fixed version
8.2.3
This is the first release that contains the fix.
npm install @grafana/data@8.2.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the patched version is not immediately possible, a temporary workaround can be implemented using a reverse proxy or similar tool to block access to the literal string {{ in the path. For example, in Nginx, you can add the following rule to block the string {{:
location ~ \{\{ {
deny all;
}
Implementing this workaround will prevent the exploitation of the XSS vulnerability until the system can be upgraded to the patched version.
Conclusion
The XSS vulnerability in the @grafana/data package of Grafana can have serious consequences, including data theft and unauthorized access. It is crucial to upgrade to the patched version (8.2.3 or later) or implement the provided workaround to mitigate the risk. For further assistance and support in vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for @grafana/data →
FAQ
The vulnerability allows an attacker to execute arbitrary JavaScript code within the victim's browser, potentially leading to data theft, session hijacking, and unauthorized access to sensitive information.
The vulnerability affects Grafana versions from 8.0.0-beta1 to 8.2.2.
No, the vulnerability requires the user to be unauthenticated and the link to be for a page containing the login button.
Grafana Cloud instances have already been patched and no evidence of exploitation has been found during the audit.
Yes, the CVSS score for this vulnerability is 6.9, indicating a medium severity level.
