Grafana JSON datasource plugin vulnerability

CVE-2023-5123

Summary

The JSON datasource plugin maintained by Grafana Labs allows administrators to retrieve and process JSON data from remote endpoints. However, a vulnerability exists due to insufficient sanitization of the path parameter supplied in dashboards. This flaw enables attackers to include path traversal characters, allowing requests to arbitrary subpaths on the configured endpoint. In scenarios where the datasource is set to point back to the Grafana instance, the situation escalates, potentially allowing for unauthorized access to sensitive administrative API endpoints. This vulnerability underscores the importance of robust input validation and the need for security measures in dashboard configurations.

References