CVE-2023-3128 Grafana vulnerable to Authentication Bypass by Spoofing
Attackers can bypass authentication and take over accounts in Grafana when Azure AD OAuth is configured with a multi-tenant application.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-3128?
CVE-2023-3128 is a critical authentication bypass vulnerability in Grafana Grafana, published on 22 Jun 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Grafana is validating Azure AD accounts based on the email claim.
On Azure AD, the profile email field is not unique and can be easily modified.
This leads to account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant app.
Weakness: CWE-290
Which versions are affected by CVE-2023-3128?
9 open source packages ship an affected version, including github.com/grafana/grafana and grafana. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/grafana/grafana Go | All versions | 8.5.27 |
github.com/grafana/grafana Go | All versions | 8.5.27 |
github.com/grafana/grafana Go | From 9.0.0 | 9.2.20 |
github.com/grafana/grafana Go | From 9.0.0 | 9.2.20 |
github.com/grafana/grafana Go | From 9.3.0 | 9.3.16 |
github.com/grafana/grafana Go | From 9.3.0 | 9.3.16 |
3 more packages
github.com/grafana/grafana Go | From 9.4.0 | 9.4.13 |
github.com/grafana/grafana Go | From 9.4.0 | 9.4.13 |
grafana Bitnami | From 6.7.0 | 8.5.27, 9.2.20, 9.3.16, 9.4.13, 9.5.4 |
Linux distribution packages (7)
grafana AlmaLinux:8 | All versions | 9.2.10-7.el8_9.alma.1 |
grafana AlmaLinux:9 | All versions | 9.0.9-3.el9_2.alma |
grafana Red Hat:enterprise_linux:9::appstream | All versions | 0:9.0.9-3.el9_2 |
grafana-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:9.0.9-3.el9_2 |
grafana-debugsource Red Hat:enterprise_linux:9::appstream | All versions | 0:9.0.9-3.el9_2 |
grafana Rocky Linux:9 | All versions | 0:9.0.9-3.el9_2 |
grafana openSUSE:Tumbleweed | All versions | 10.0.1-1.1 |
Products include Grafana Grafana.
How do I fix CVE-2023-3128?
Upgrade github.com/grafana/grafana to a fixed version for your release line: 8.5.27, 9.2.20, 9.3.16 or 9.4.13.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2023-3128 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-3128 exists.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Grafana Grafana
Sources
Also known as ALSA-2023:4030, ALSA-2023:6972, BIT-grafana-2023-3128, GHSA-gxh2-6vvc-rrgp, GHSA-mpv3-g8m3-3fjc, RHSA-2023:4030 and 3 more.