Attachment 229549 Details for Bug 259638 – vuxml.diff

[patch] vuxml.diff

vuxml-grafana8.diff (text/plain), 2.88 KB, created by Boris Korzun on 2021-11-17 12:28:15 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Boris Korzun

Created: 2021-11-17 12:28:15 UTC

Size: 2.88 KB

patch

obsolete

>diff --git a/security/vuxml/vuln-2021.xml b/security/vuxml/vuln-2021.xml
>index ae2e7d778fb9..7eb97d2dae7e 100644
>--- a/security/vuxml/vuln-2021.xml
>+++ b/security/vuxml/vuln-2021.xml
>@@ -1,3 +1,46 @@
>+ <vuln vid="4b478274-47a0-11ec-bd24-6c3be5272acd">
>+ <topic>Grafana -- XSS</topic>
>+ <affects>
>+ <package>
>+	<name>grafana8</name>
>+	<name>grafana</name>
>+	<range><ge>8.0.0</ge><lt>8.2.3</lt></range>
>+ </package>
>+ </affects>
>+ <description>
>+ <body xmlns="http://www.w3.org/1999/xhtml">
>+	Grafana Labs reports:
>+	<blockquote cite="https://grafana.com/blog/2021/11/03/grafana-8.2.3-released-with-medium-severity-security-fix-cve-2021-41174-grafana-xss/">
>+	 If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, arbitrary JavaScript content may be executed within the context of the victimâs browser.
>+	 The user visiting the malicious link must be unauthenticated, and the link must be for a page that contains the login button in the menu bar.
>+	 There are two ways an unauthenticated user can open a page in Grafana that contains the login button:
>+	 <ul>
>+	 <li>Anonymous authentication is enabled. This means all pages in Grafana would be open for the attack.</li>
>+	 <li>The link is to an unauthenticated page. The following pages are vulnerable:
>+	 <ul>
>+		<li><code>/dashboard-solo/snapshot/*</code></li>
>+		<li><code>/dashboard/snapshot/*</code></li>
>+		<li><code>/invite/:code</code></li>
>+	 </ul>
>+	 </li>
>+	 </ul>
>+	 The url has to be crafted to exploit AngularJS rendering and contain the interpolation binding for AngularJS expressions. AngularJS uses double curly braces for interpolation binding: <code>{{ }}</code>
>+	 An example of an expression would be: <code>{{constructor.constructor(âalert(1)â)()}}</code>. This can be included in the link URL like this:
>+	 <a href="https://play.grafana.org/dashboard/snapshot/%7B%7Bconstructor.constructor('alert(1)')()%7D%7D?orgId=1">https://play.grafana.org/dashboard/snapshot/%7B%7Bconstructor.constructor('alert(1)')()%7D%7D?orgId=1</a>
>+	 When the user follows the link and the page renders, the login button will contain the original link with a query parameter to force a redirect to the login page. The URL is not validated, and the AngularJS rendering engine will execute the JavaScript expression contained in the URL.
>+	</blockquote>
>+ </body>
>+ </description>
>+ <references>
>+ <cvename>CVE-2021-41174</cvename>
>+ <url>https://grafana.com/blog/2021/11/03/grafana-8.2.3-released-with-medium-severity-security-fix-cve-2021-41174-grafana-xss/</url>
>+ </references>
>+ <dates>
>+ <discovery>2021-10-21</discovery>
>+ <entry>2021-11-17</entry>
>+ </dates>
>+ </vuln>
>+
> <vuln vid="b8c0cbca-472d-11ec-83dc-3065ec8fd3ec">
> <topic>chromium -- multiple vulnerabilities</topic>
> <affects>

Actions: View | Diff

Attachments on bug 259638: 229261 | 229549 | 229570 | 229571 | 229575 | 229850 | 229973 | 229974