CVE-2024-1313 Users outside an organization can delete a snapshot with its key
An attacker can delete snapshots belonging to other organizations by exploiting a flaw in the API authorization logic.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-1313?
CVE-2024-1313 is a medium-severity missing authorization vulnerability in Grafana, published on 26 Mar 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
It is possible for a user in a different organization from the owner of a snapshot to bypass authorization and delete a snapshot by issuing a DELETE request to /api/snapshots/<key> using its view key. This functionality is intended to only be available to individuals with the permission to write/edit to the snapshot in question, but due to a bug in the authorization logic, deletion requests issued by an unprivileged user in a different organization than the snapshot owner are treated as authorized.
Grafana Labs would like to thank Ravid Mazon and Jay Chen of Palo Alto Research for discovering and disclosing this vulnerability.
This issue affects Grafana: from 9.5.0 before 9.5.18, from 10.0.0 before 10.0.13, from 10.1.0 before 10.1.9, from 10.2.0 before 10.2.6, from 10.3.0 before 10.3.5.
Weakness: CWE-639
Which versions are affected by CVE-2024-1313?
12 open source packages ship an affected version, including github.com/grafana/grafana and grafana.
| Package | Affected | Fixed in |
|---|---|---|
github.com/grafana/grafana Go | All versions | None |
github.com/grafana/grafana Go | From 10.0.0 | 10.0.13 |
github.com/grafana/grafana Go | From 10.0.0 | 10.0.13 |
github.com/grafana/grafana Go | From 10.1.0 | 10.1.9 |
github.com/grafana/grafana Go | From 10.1.0 | 10.1.9 |
github.com/grafana/grafana Go | From 10.2.0 | 10.2.6 |
6 more packages
github.com/grafana/grafana Go | From 10.2.0 | 10.2.6 |
github.com/grafana/grafana Go | From 10.3.0 | 10.3.5 |
github.com/grafana/grafana Go | From 10.3.0 | 10.3.5 |
github.com/grafana/grafana Go | From 9.5.0 | 9.5.18 |
github.com/grafana/grafana Go | From 9.5.0 | 9.5.18 |
grafana Bitnami | From 9.5.0 | 9.5.18, 10.0.13, 10.1.9, 10.2.6, 10.3.5 |
Linux distribution packages (13)
grafana SUSE:Manager Client Tools 12-BETA | All versions | 9.5.18-4.30.4 |
mgr-push SUSE:Manager Client Tools 12-BETA | All versions | 5.0.2-4.24.5 |
spacecmd SUSE:Manager Client Tools 12-BETA | All versions | 5.0.6-41.51.3 |
uyuni-common-libs SUSE:Manager Client Tools 12-BETA | All versions | 5.0.3-3.39.3 |
uyuni-tools SUSE:Manager Client Tools 12-BETA | All versions | 0.1.9-3.11.4 |
grafana SUSE:Manager Client Tools 15-BETA | All versions | 9.5.18-159000.4.33.4 |
mgr-push SUSE:Manager Client Tools 15-BETA | All versions | 5.0.2-159000.4.24.5 |
spacecmd SUSE:Manager Client Tools 15-BETA | All versions | 5.0.6-159000.6.51.4 |
uyuni-common-libs SUSE:Manager Client Tools 15-BETA | All versions | 5.0.3-159000.3.39.3 |
uyuni-tools SUSE:Manager Client Tools 15-BETA | All versions | 0.1.9-159000.3.11.5 |
golang-github-prometheus-node_exporter SUSE:Manager Client Tools Beta for SLE Micro 5 | All versions | 1.7.0-159000.6.5.5 |
uyuni-tools SUSE:Manager Client Tools Beta for SLE Micro 5 | All versions | 0.1.9-159000.3.11.5 |
grafana openSUSE:Tumbleweed | All versions | 10.3.5-1.1 |
How do I fix CVE-2024-1313?
Upgrade github.com/grafana/grafana to a fixed version for your release line: 10.0.13, 10.1.9, 10.2.6 or 10.3.5.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-1313 being exploited?
There is no known exploitation of CVE-2024-1313 in the wild and no public exploit code.
Sources
Also known as BIT-grafana-2024-1313, GHSA-67rv-qpw2-6qrr, GO-2024-2697, MINI-3xxw-p477-vpwf, MINI-4w8g-v6fm-pw8g, MINI-5j65-5ph6-6w2p and 18 more.