Open-source data analytics and visualisations organisation Grafana have released a new security update for their app that patches a critical severity authorisation bypass flaw. This vulnerability affects Grafana accounts that use Azure Active Directory (AD) for account authentication. The new releases include Grafana versions 10.0.1, 9.5.5, 9.4.13, 9.3.16, 9.2.20, and 8.5.27. Other security fixes are also included in these versions so all users should update their Grafana apps regardless of if they use Azure AD authentication on their accounts. The organisation have confirmed that patches have already been applied to Grafana Cloud.
The critical vulnerability tracked as CVE-2023-3128 has been assigned a CVSS base score of 9.4. When Azure AD is used to validate a Grafana account, it uses the email claim, however the profile email field on Azure AD is not unique across tenants and can be easily modified. An attacker can therefore perform an account takeover and authentication bypass on any Grafana account using multi-tenant Azure AD OAuth application. This would lead the attacker to obtain full control of the Grafana account, including gaining access to private data and sensitive information. This authentication bypass can only be performed if the multi-tenant Azure AD OAuth app used does not have allowed_groups configured.
The security advisory released by Grafana about this recent update confirms this vulnerability affects version 6.7.0 and all previous versions. As well as updating to a fixed version of the app, Grafana suggest an alternative mitigation to this flaw. Because this vulnerability can only be exploited in apps without allowed_groups being configured, adding allowed_groups can prevent an attacker from bypassing the authentication. This is because when allowed_groups is configured the user signing in is checked against a list of members in an Azure AD group, meaning the profile email cannot be replaced by an attacker. This vulnerability also only applies to multi-tenant authentication scenarios, so registering a single tenant application in Azure AD will also mitigate this flaw and prevent attack.
“We were very impressed with the service, I will say, the vulnerability found was one our previous organisation had not picked up, which does make you wonder if anything else was missed.”
Aim Ltd Chief Technology Officer (CTO)