2023-06-27 02:25:40
One of the most popular open source systems for analytics and visualization, Grafana, was found to have a security flaw that provides level facilities, and provides tools for data analytics and visualization that are easy to use and aesthetically pleasing.
The security issue, which was assigned the identifier CVE-2023-3128 and received a score of 9.4 out of 10 on the CVSS severity scale, has the potential to allow an adversary to bypass authentication protocols and obtain the control of a user’s account. In its most basic form, the CVE-2023-3128 vulnerability in Grafana allows you to bypass authentication or take over another user’s account. The validation method used by Grafana is the main cause of this vulnerability. Grafana can specifically verify Azure Active Directory (Azure AD) accounts based on their email notification when used in combination with Azure Active Directory (Azure AD) OAuth. This is where the difficulty lies. Because the email address used in the profile box is not guaranteed to be unique across all Azure AD tenants,
The scope of the potential repercussions of this vulnerability is vast and worrisome. By exploiting this vulnerability, attackers can take full control of a user’s account, giving them access to sensitive customer data as well as other important information.
The vulnerability is most prevalent in Grafana installations that use Azure AD OAuth and are configured with a multi-tenant Azure AD OAuth application, but do not have an allow_groups option. It is imperative that you act quickly if you are using a version of Grafana that is 6.7.0 or later.
The Grafana development team quickly reacted to this urgent issue by patching the vulnerability in versions 10.0.1, 9.5.5, 9.4.13, 9.3.16, 9.2.20, and 8.5.27 respectively. You are safe as long as the version of Grafana you are using is one of these or later.
But what if an upgrade isn’t something that can be done right away? The good news is that there are mitigation strategies that can be implemented. First, you can ensure that a user who signs in also belongs to a group in Azure AD by adding an allow_groups parameter to your Azure AD configuration. Due to this step, the possibility of an attacker using arbitrary email has been significantly reduced.
Alternatively, the attack vector can be effectively eliminated by registering a single-tenant application in Azure Active Directory. This eliminates the possibility of cross-tenant spoofing, which is the attack vector.
He is a well-known expert in mobile security and malware analysis. He studied Computer Science at NYU and started working as a cyber security analyst in 2003. He is actively working as an anti-malware expert. He has also worked for security companies such as Kaspersky Lab. His daily work includes investigating new malware and cybersecurity incidents. He also has a deep level of knowledge in mobile security and mobile vulnerabilities.
Send news tips to [email protected] or www.instagram.com/iicsorg/
You can also find us on Telegram www.t.me/noticiasciberseguridad
#Hacking #Grafana #servers #Azure