We have released version 5.24.0 of the Grafana Operator. This patch includes a MEDIUM severity security fix for a path traversal\/privilege escalation vulnerability in the Grafana Operator.<\/p>\n
### Summary<\/p>\n
The Grafana Operator supports loading dashboards & library panels using the jsonnet data templating language. The jsonnet expression is evaluated in the context of the operator manager pod.<\/p>\n
### Impact<\/p>\n
It is possible for a malicious user who can create Dashboard or LibraryPanel resources for a Grafana instance to obtain the Kubernetes service account token of the Grafana Operator manager.<\/p>\n
### Affected versions<\/p>\n
All Grafana Operator versions <= 5.23<\/p>\n
### Solutions and mitigations<\/p>\n
All installations should be upgraded as soon as possible.<\/p>\n
As a workaround, the following ValidatingAdmissionPolicy prevent the creation or modification of jsonnet based resources:<\/p>\n
apiVersion: admissionregistration.k8s.io\/v1
\nkind: ValidatingAdmissionPolicy
\nmetadata:
\n name: "prevent-jsonnet-dashboards"
\nspec:
\n failurePolicy: Fail
\n matchConstraints:
\n resourceRules:
\n – apiGroups: ["grafana.integreatly.org"]
\n apiVersions: ["v1beta1"]
\n operations: ["CREATE", "UPDATE"]
\n resources: ["grafanadashboards", "grafanalibrarypanels"]
\n validations:
\n – expression: "!has(object.spec.jsonnetLib)"
\n—
\napiVersion: admissionregistration.k8s.io\/v1
\nkind: ValidatingAdmissionPolicyBinding
\nmetadata:
\n name: "prevent-jsonnet-dashboards-clusterwide"
\nspec:
\n policyName: "prevent-jsonnet-dashboards"
\n validationActions: [Deny]<\/p>\n
### Acknowledgement<\/p>\n
We would like to thank Artem Cherezov for responsibly disclosing the vulnerability.<\/p>\n","protected":false},"excerpt":{"rendered":"
We have released version 5.24.0 of the Grafana Operator. This patch includes a MEDIUM severity security fix for a path traversal\/privilege escalation vulnerability in the Grafana Operator.<\/p>\n
### Summa<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-16805","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/16805","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=16805"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=16805"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=16805"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}