CVE-2022-35957 Authentication Bypass in Grafana via auth proxy allowing escalation from admin to server admin
An admin can escalate to server admin and take over the instance when auth proxy is enabled, requiring immediate upgrade or disabling the feature.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-35957?
CVE-2022-35957 is a medium-severity authentication bypass vulnerability in Fedoraproject Fedora, published on 20 Sep 2022. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Grafana is an open-source platform for monitoring and observability. Versions prior to 9.1.6 and 8.5.13 are vulnerable to an escalation from admin to server admin when auth proxy is used, allowing an admin to take over the server admin account and gain full control of the grafana instance. All installations should be upgraded as soon as possible. As a workaround deactivate auth proxy following the instructions at: https://grafana.com/docs/grafana/latest/setup-grafana/configure-security/configure-authentication/auth-proxy/
Weakness: CWE-290
Which versions are affected by CVE-2022-35957?
8 open source packages ship an affected version, including github.com/grafana/grafana and grafana. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
github.com/grafana/grafana Go | All versions | None |
github.com/grafana/grafana Go | All versions | 8.5.13 |
github.com/grafana/grafana Go | All versions | 8.5.13 |
github.com/grafana/grafana Go | From 9.0.0 | 9.0.9 |
github.com/grafana/grafana Go | From 9.0.0 | 9.0.9 |
github.com/grafana/grafana Go | From 9.1.0 | 9.1.6 |
2 more packages
github.com/grafana/grafana Go | From 9.1.0 | 9.1.6 |
grafana Bitnami | All versions | 8.5.13, 9.0.9, 9.1.6 |
Products include Fedoraproject Fedora, Grafana Grafana.
How do I fix CVE-2022-35957?
Upgrade github.com/grafana/grafana to a fixed version for your release line: 8.5.13, 9.0.9 or 9.1.6.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2022-35957 being exploited?
There is no known exploitation of CVE-2022-35957 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as BIT-grafana-2022-35957, GHSA-ff5c-938w-8c9q, GO-2024-2847, MINI-3mmg-9m4v-3rjf, MINI-43j8-q9j5-gww2, MINI-68j3-5rm5-jpv4 and 15 more.