Improper access control in Grafana - CVE-2021-39226

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU57320

Improper access control in Grafana - CVE-2021-39226

Published: October 12, 2021 / Updated: September 3, 2022


Vulnerability identifier: #VU57320
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-39226
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability: The vulnerability is being exploited in the wild

Vulnerability details

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions to database snapshots. Remote unauthenticated and authenticated users are able to view the snapshot with the lowest database key by accessing the literal paths: /dashboard/snapshot/:key, or /api/snapshots/:key. If the snapshot "public_mode" configuration setting is set to true (vs default of false), unauthenticated users are able to delete the snapshot with the lowest database key by accessing the literal path: /api/snapshots-delete/:deleteKey.

Regardless of the snapshot "public_mode" setting, authenticated users are able to delete the snapshot with the lowest database key by accessing the literal paths: /api/snapshots/:key, or /api/snapshots-delete/:deleteKey. The combination of deletion and viewing enables a complete walk through all snapshot data while resulting in complete snapshot data loss.


Affected software

Grafana
SUSE Linux Enterprise Desktop 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Manager Server
SUSE Linux Enterprise Module for SUSE Manager Server
SUSE Enterprise Storage
HPE Helion Openstack
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
SUSE OpenStack Cloud
Anolis OS
SUSE OpenStack Cloud Crowbar
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux Server - AUS
SUSE Manager Tools
SUSE Manager Client Tools Beta for SLE
SUSE Linux Enterprise Server for the Raspberry Pi
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Desktop
openSUSE Leap
openEuler
Fedora
NGINX Service Mesh
Astronomer with IBM
Red Hat OpenShift Container Platform
grafana (Red Hat package)
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions
openstack-heat-templates
kiwi-desc-saltboot
golang-github-QubitProducts-exporter_exporter
prometheus-postgres_exporter
golang-github-prometheus-promu
prometheus-blackbox_exporter-debuginfo
prometheus-blackbox_exporter
golang-github-prometheus-alertmanager
system-user-grafana
system-user-prometheus
golang-github-lusitaniae-apache_exporter
zypp-plugin-spacewalk
python2-zypp-plugin-spacewalk
python3-zypp-plugin-spacewalk
supportutils-plugin-salt
golang-github-prometheus-node_exporter
golang-github-boynux-squid_exporter
python-Django1
python-Django
python2-hwdata
python3-hwdata
ansible
ansible-doc
rubygem-puma-debugsource
ruby2.1-rubygem-puma-debuginfo
ruby2.1-rubygem-puma
golang-github-prometheus-prometheus
rabbitmq-server
rabbitmq-server-plugins
python-murano
openstack-murano-engine
openstack-murano-doc
openstack-murano-api
openstack-murano
venv-openstack-murano-x86_64
mgr-virtualization-host
python3-mgr-virtualization-common
python3-mgr-virtualization-host
python3-spacewalk-oscap
spacewalk-oscap
python3-mgr-push
mgr-push
python3-suseRegisterInfo
suseRegisterInfo
python3-spacewalk-koan
spacewalk-koan
python3-rhnlib
python3-mgr-cfg-client
mgr-cfg
mgr-cfg-actions
python3-mgr-cfg-actions
python3-mgr-cfg
python3-mgr-cfg-management
mgr-cfg-management
mgr-cfg-client
mgr-osad
python3-mgr-osad
python3-mgr-osa-common
spacecmd
spacewalk-client-setup
spacewalk-client-tools
spacewalk-check
python3-spacewalk-client-tools
python3-spacewalk-client-setup
python3-spacewalk-check
python2-uyuni-common-libs
python2-mgr-virtualization-host
python2-mgr-virtualization-common
python2-mgr-push
supportutils-plugin-susemanager-client
python2-spacewalk-oscap
python2-rhnlib
python2-spacewalk-koan
spacewalk-remote-utils
python2-suseRegisterInfo
python3-uyuni-common-libs
mgr-custom-info
python2-mgr-cfg-management
python2-mgr-cfg
python2-mgr-cfg-actions
python2-mgr-cfg-client
python2-mgr-osad
python2-mgr-osa-common
mgr-daemon
python2-spacewalk-client-tools
python2-spacewalk-client-setup
python2-spacewalk-check
grafana-stackdriver
grafana
grafana-azure-monitor
grafana-cloudwatch
grafana-elasticsearch
grafana-graphite
grafana-influxdb
grafana-loki
grafana-mssql
grafana-mysql
grafana-opentsdb
grafana-postgres
grafana-prometheus
grafana-debuginfo
ardana-cobbler
ardana-ansible
ardana-tempest
venv-openstack-heat-x86_64
venv-openstack-horizon-hpe-x86_64
venv-openstack-horizon-x86_64
venv-openstack-neutron-x86_64
python-horizon-plugin-gbp-ui
openstack-horizon-plugin-gbp-ui
python-neutron-gbp
openstack-neutron-gbp
venv-openstack-nova-x86_64
openstack-nova-cells
python-nova
openstack-nova-vncproxy
openstack-nova-serialproxy
openstack-nova-scheduler
openstack-nova-placement-api
openstack-nova-novncproxy
openstack-nova-console
openstack-nova-conductor
openstack-nova-compute
openstack-nova
openstack-nova-api
salt-minion
python3-salt
salt
salt-doc
python2-salt
salt-fish-completion
salt-bash-completion
salt-syndic
salt-standalone-formulas-configuration
salt-ssh
salt-proxy
salt-master
salt-cloud
salt-api
salt-zsh-completion

How to mitigate CVE-2021-39226

Install updates from vendor's website.

Grafana - addressed in versions 7.5.11, 8.1.6
NGINX Service Mesh - update to 1.2.1
Astronomer with IBM - update to 0.37.1
Red Hat OpenShift Container Platform - addressed in versions 3.11.784, 4.6.61, 4.7.59, 4.8.49, 4.9.48
grafana (Red Hat package) - addressed in versions 6.2.2-7.el8_1, 6.3.6-3.el8_2, 7.3.6-3.el8_4
openstack-heat-templates - addressed in versions 0.0.0+git.1654529662.75fa04a-3.27.1, 0.0.0+git.1654529662.75fa04a7-3.15.1
kiwi-desc-saltboot - addressed in versions 0.1.1639488226.7c9eab9-4.12.1, 0.1.1687520761.cefb248-4.15.2
golang-github-QubitProducts-exporter_exporter - addressed in versions 0.4.0-1.6.1, 0.4.0-4.6.2
prometheus-postgres_exporter - addressed in versions 0.10.0-1.8.2, 0.10.0-150000.1.3.1, 0.10.1-3.6.4
golang-github-prometheus-promu - update to 0.14.0-4.12.2
prometheus-blackbox_exporter-debuginfo - addressed in versions 0.19.0-1.8.2, 0.24.0-3.6.3
prometheus-blackbox_exporter - addressed in versions 0.19.0-1.8.2, 0.24.0-3.6.3
golang-github-prometheus-alertmanager - addressed in versions 0.23.0-1.12.3, 0.26.0-4.12.4
system-user-grafana - update to 1.0.0-3.7.2
system-user-prometheus - update to 1.0.0-3.7.2
golang-github-lusitaniae-apache_exporter - update to 1.0.0-4.12.4
zypp-plugin-spacewalk - addressed in versions 1.0.11-33.18.1, 1.0.11-159000.6.18.3
python2-zypp-plugin-spacewalk - update to 1.0.11-33.18.1
python3-zypp-plugin-spacewalk - update to 1.0.11-159000.6.18.3
supportutils-plugin-salt - addressed in versions 1.2.0-6.16.1, 1.2.2-9.9.2
golang-github-prometheus-node_exporter - addressed in versions 1.3.0-1.15.3, 1.5.0-4.15.4
golang-github-boynux-squid_exporter - update to 1.6-4.9.2
python-Django1 - update to 1.11.29-3.40.1
python-Django - update to 1.11.29-3.42.1
python2-hwdata - addressed in versions 2.3.5-12.9.1, 2.3.5-15.9.1, 2.3.5-15.12.2
python3-hwdata - update to 2.3.5-159000.5.10.3
ansible - update to 2.9.21-159000.3.6.2
ansible-doc - update to 2.9.21-159000.3.6.2
rubygem-puma-debugsource - addressed in versions 2.16.0-3.18.1, 2.16.0-4.18.1
ruby2.1-rubygem-puma-debuginfo - addressed in versions 2.16.0-3.18.1, 2.16.0-4.18.1
ruby2.1-rubygem-puma - addressed in versions 2.16.0-3.18.1, 2.16.0-4.18.1
golang-github-prometheus-prometheus - update to 2.45.0-4.33.3
rabbitmq-server - addressed in versions 3.6.16-3.13.1, 3.6.16-4.3.1
rabbitmq-server-plugins - addressed in versions 3.6.16-3.13.1, 3.6.16-4.3.1
python-murano - update to 4.0.2~dev3-3.12.1
openstack-murano-engine - update to 4.0.2~dev3-3.12.1
openstack-murano-doc - update to 4.0.2~dev3-3.12.1
openstack-murano-api - update to 4.0.2~dev3-3.12.1
openstack-murano - update to 4.0.2~dev3-3.12.1
venv-openstack-murano-x86_64 - update to 4.0.2~dev3-12.38.1
mgr-virtualization-host - addressed in versions 4.2.4-150000.1.26.1, 4.3.2-4.12.2, 4.3.2-159000.4.12.3, 4.3.5-1.29.3
python3-mgr-virtualization-common - addressed in versions 4.2.4-150000.1.26.1, 4.3.2-159000.4.12.3
python3-mgr-virtualization-host - addressed in versions 4.2.4-150000.1.26.1, 4.3.2-159000.4.12.3
python3-spacewalk-oscap - addressed in versions 4.2.4-150000.3.18.1, 4.3.2-159000.6.12.3
spacewalk-oscap - addressed in versions 4.2.4-150000.3.18.1, 4.3.2-22.12.1, 4.3.2-159000.6.12.3, 4.3.5-19.27.1
python3-mgr-push - addressed in versions 4.2.5-150000.1.18.2, 4.3.2-159000.4.12.4
mgr-push - addressed in versions 4.2.5-150000.1.18.2, 4.3.2-4.12.2, 4.3.2-159000.4.12.4, 4.3.4-1.21.4, 5.0.1-4.21.4
python3-suseRegisterInfo - addressed in versions 4.2.6-150000.3.21.1, 4.3.2-159000.6.18.3
suseRegisterInfo - addressed in versions 4.2.6-150000.3.21.1, 4.3.2-28.18.1, 4.3.2-159000.6.18.3, 4.3.3-25.27.3
python3-spacewalk-koan - addressed in versions 4.2.6-150000.3.27.1, 4.3.2-159000.6.12.3
spacewalk-koan - addressed in versions 4.2.6-150000.3.27.1, 4.3.2-27.12.1, 4.3.2-159000.6.12.3, 4.3.5-24.33.3
python3-rhnlib - addressed in versions 4.2.6-150000.3.34.1, 4.3.2-159000.6.21.3
python3-mgr-cfg-client - addressed in versions 4.2.8-150000.1.24.1, 4.3.4-159000.4.20.2
mgr-cfg - addressed in versions 4.2.8-150000.1.24.1, 4.3.3-4.18.2, 4.3.4-159000.4.20.2, 4.3.6-1.27.4
mgr-cfg-actions - addressed in versions 4.2.8-150000.1.24.1, 4.3.3-4.18.2, 4.3.4-159000.4.20.2, 4.3.6-1.27.4
python3-mgr-cfg-actions - addressed in versions 4.2.8-150000.1.24.1, 4.3.4-159000.4.20.2
python3-mgr-cfg - addressed in versions 4.2.8-150000.1.24.1, 4.3.4-159000.4.20.2
python3-mgr-cfg-management - addressed in versions 4.2.8-150000.1.24.1, 4.3.4-159000.4.20.2
mgr-cfg-management - addressed in versions 4.2.8-150000.1.24.1, 4.3.3-4.18.2, 4.3.4-159000.4.20.2, 4.3.6-1.27.4
mgr-cfg-client - addressed in versions 4.2.8-150000.1.24.1, 4.3.3-4.18.2, 4.3.4-159000.4.20.2, 4.3.6-1.27.4
mgr-osad - addressed in versions 4.2.8-150000.1.36.1, 4.3.3-4.21.2, 4.3.3-159000.4.21.4, 4.3.6-1.39.4
python3-mgr-osad - addressed in versions 4.2.8-150000.1.36.1, 4.3.3-159000.4.21.4
python3-mgr-osa-common - addressed in versions 4.2.8-150000.1.36.1, 4.3.3-159000.4.21.4
spacecmd - addressed in versions 4.2.16-150000.3.77.1, 4.3.5-41.30.1, 4.3.5-159000.6.30.3, 4.3.11-38.103.3, 5.0.1-41.42.3
spacewalk-client-setup - addressed in versions 4.2.18-150000.3.59.1, 4.3.5-55.36.2, 4.3.5-159000.6.36.5, 4.3.9-52.71.3
spacewalk-client-tools - addressed in versions 4.2.18-150000.3.59.1, 4.3.5-55.36.2, 4.3.5-159000.6.36.5, 4.3.9-52.71.3
spacewalk-check - addressed in versions 4.2.18-150000.3.59.1, 4.3.5-55.36.2, 4.3.5-159000.6.36.5, 4.3.9-52.71.3
python3-spacewalk-client-tools - addressed in versions 4.2.18-150000.3.59.1, 4.3.5-159000.6.36.5
python3-spacewalk-client-setup - addressed in versions 4.2.18-150000.3.59.1, 4.3.5-159000.6.36.5
python3-spacewalk-check - addressed in versions 4.2.18-150000.3.59.1, 4.3.5-159000.6.36.5
python2-uyuni-common-libs - addressed in versions 4.3.2-3.24.1, 4.3.4-1.21.3, 5.0.1-3.33.3
python2-mgr-virtualization-host - addressed in versions 4.3.2-4.12.2, 4.3.5-1.29.3
python2-mgr-virtualization-common - addressed in versions 4.3.2-4.12.2, 4.3.5-1.29.3
python2-mgr-push - addressed in versions 4.3.2-4.12.2, 4.3.4-1.21.4, 5.0.1-4.21.4
supportutils-plugin-susemanager-client - addressed in versions 4.3.2-6.24.1, 5.0.1-9.15.2
python2-spacewalk-oscap - addressed in versions 4.3.2-22.12.1, 4.3.5-19.27.1
python2-rhnlib - addressed in versions 4.3.2-24.21.1, 4.3.4-21.43.3, 5.0.1-24.30.3
python2-spacewalk-koan - addressed in versions 4.3.2-27.12.1, 4.3.5-24.33.3
spacewalk-remote-utils - addressed in versions 4.3.2-27.12.2, 4.3.2-159000.6.12.3, 4.3.3-24.24.3
python2-suseRegisterInfo - addressed in versions 4.3.2-28.18.1, 4.3.3-25.27.3
python3-uyuni-common-libs - update to 4.3.2-159000.3.24.4
mgr-custom-info - addressed in versions 4.3.3-1.18.1, 4.3.3-4.12.1, 4.3.3-159000.4.12.3
python2-mgr-cfg-management - addressed in versions 4.3.3-4.18.2, 4.3.6-1.27.4
python2-mgr-cfg - addressed in versions 4.3.3-4.18.2, 4.3.6-1.27.4
python2-mgr-cfg-actions - addressed in versions 4.3.3-4.18.2, 4.3.6-1.27.4
python2-mgr-cfg-client - addressed in versions 4.3.3-4.18.2, 4.3.6-1.27.4
python2-mgr-osad - addressed in versions 4.3.3-4.21.2, 4.3.6-1.39.4
python2-mgr-osa-common - addressed in versions 4.3.3-4.21.2, 4.3.6-1.39.4
mgr-daemon - update to 4.3.4-1.32.3
python2-spacewalk-client-tools - addressed in versions 4.3.5-55.36.2, 4.3.9-52.71.3
python2-spacewalk-client-setup - addressed in versions 4.3.5-55.36.2, 4.3.9-52.71.3
python2-spacewalk-check - addressed in versions 4.3.5-55.36.2, 4.3.9-52.71.3
grafana-stackdriver - update to 6.3.6-3.0.1
grafana - update to 6.3.6-3.0.1
grafana-azure-monitor - update to 6.3.6-3.0.1
grafana-cloudwatch - update to 6.3.6-3.0.1
grafana-elasticsearch - update to 6.3.6-3.0.1
grafana-graphite - update to 6.3.6-3.0.1
grafana-influxdb - update to 6.3.6-3.0.1
grafana-loki - update to 6.3.6-3.0.1
grafana-mssql - update to 6.3.6-3.0.1
grafana-mysql - update to 6.3.6-3.0.1
grafana-opentsdb - update to 6.3.6-3.0.1
grafana-postgres - update to 6.3.6-3.0.1
grafana-prometheus - update to 6.3.6-3.0.1
grafana-debuginfo - addressed in versions 6.7.4-3.29.1, 6.7.4-4.23.1, 8.3.5-150000.1.30.1
grafana - addressed in versions 6.7.4-3.29.1, 6.7.4-4.23.1, 7.5.12-1.27.1, 7.5.12-4.18.1, 7.5.12-150100.3.9.1, 7.5.12-159000.4.18.3, 8.3.5-1.30.3, 8.3.5-150000.1.30.1, 9.5.8-4.21.2
grafana - addressed in versions 7.5.11-1.fc34, 7.5.11-1.fc35
grafana - update to 7.5.15-3
grafana-debuginfo - update to 7.5.15-3
ardana-cobbler - addressed in versions 8.0+git.1660773402.d845a45-3.47.1, 9.0+git.1660747489.119efcd-3.19.1
ardana-ansible - addressed in versions 8.0+git.1660773729.3789a6d-3.85.1, 9.0+git.1660748476.c118d23-3.32.1
ardana-tempest - update to 9.0+git.1651855288.a2341ad-3.22.1
venv-openstack-heat-x86_64 - addressed in versions 9.0.8~dev22-12.45.1, 11.0.4~dev4-3.37.1
venv-openstack-horizon-hpe-x86_64 - update to 12.0.5~dev6-14.48.1
venv-openstack-horizon-x86_64 - addressed in versions 12.0.5~dev6-14.48.1, 14.1.1~dev11-4.41.1
venv-openstack-neutron-x86_64 - update to 13.0.8~dev206-6.41.1
python-horizon-plugin-gbp-ui - update to 14.0.1~dev4-3.12.1
openstack-horizon-plugin-gbp-ui - update to 14.0.1~dev4-3.12.1
python-neutron-gbp - update to 14.0.1~dev46-3.34.1
openstack-neutron-gbp - update to 14.0.1~dev46-3.34.1
venv-openstack-nova-x86_64 - update to 18.3.1~dev92-3.41.1
openstack-nova-cells - update to 18.3.1~dev92-3.43.1
python-nova - update to 18.3.1~dev92-3.43.1
openstack-nova-vncproxy - update to 18.3.1~dev92-3.43.1
openstack-nova-serialproxy - update to 18.3.1~dev92-3.43.1
openstack-nova-scheduler - update to 18.3.1~dev92-3.43.1
openstack-nova-placement-api - update to 18.3.1~dev92-3.43.1
openstack-nova-novncproxy - update to 18.3.1~dev92-3.43.1
openstack-nova-console - update to 18.3.1~dev92-3.43.1
openstack-nova-conductor - update to 18.3.1~dev92-3.43.1
openstack-nova-compute - update to 18.3.1~dev92-3.43.1
openstack-nova - update to 18.3.1~dev92-3.43.1
openstack-nova-api - update to 18.3.1~dev92-3.43.1
salt-minion - addressed in versions 3000-49.41.3, 3003.3-159000.8.47.2
python3-salt - addressed in versions 3000-49.41.3, 3003.3-159000.8.47.2
salt - addressed in versions 3000-49.41.3, 3003.3-159000.8.47.2
salt-doc - addressed in versions 3000-49.41.3, 3003.3-159000.8.47.2
python2-salt - update to 3000-49.41.3
salt-fish-completion - update to 3003.3-159000.8.47.2
salt-bash-completion - update to 3003.3-159000.8.47.2
salt-syndic - update to 3003.3-159000.8.47.2
salt-standalone-formulas-configuration - update to 3003.3-159000.8.47.2
salt-ssh - update to 3003.3-159000.8.47.2
salt-proxy - update to 3003.3-159000.8.47.2
salt-master - update to 3003.3-159000.8.47.2
salt-cloud - update to 3003.3-159000.8.47.2
salt-api - update to 3003.3-159000.8.47.2
salt-zsh-completion - update to 3003.3-159000.8.47.2

Links to Public Exploits and PoC-codes

External References

Related Security Bulletins