GitHub Security Advisory: GHSA-mx47-6497-3fv2
Package: github.com/grafana/grafana (GO)
Severity: HIGH (CVSS 7.1)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: >= 5.3.0-beta1, < 8.3.10
Patched in: 8.3.10

Summary: Grafana account takeover via OAuth vulnerability

Details:
Today we are releasing Grafana 8.3.10, 8.4.10, 8.5.9 and 9.0.3. This patch release includes a HIGH severity security fix for an Oauth takeover vulnerability in Grafana.

Release v.9.0.3, containing this security fix and other patches:

- [Download Grafana 9.0.3](https://grafana.com/grafana/download/9.0.3)
- [Release notes](https://grafana.com/docs/grafana/next/release-notes/release-notes-9-0-3/)

Release v.8.5.9, containing this security fix and other fixes:

- [Download Grafana 8.5.9](https://grafana.com/grafana/download/8.5.9)
- [Release notes](https://grafana.com/docs/grafana/next/release-notes/release-notes-8-5-9/)

Release v.8.4.10, containing this security fix and other fixes:

- [Download Grafana 8.4.10](https://grafana.com/grafana/download/8.4.10)
- [Release notes](https://grafana.com/docs/grafana/next/release-notes/release-notes-8-4-10/)

Release v.8.3.10, containing this security fix and other fixes:

- [Download Grafana 8.3.10](https://grafana.com/grafana/download/8.3.10)

## Grafana account takeover via OAuth vulnerability ([CVE-2022-31107](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-31107))

### Summary
On June 27 the HTTPVoid team contacted Grafana Labs to disclose a Grafana account takeover via an OAuth vulnerability.

We believe that this vulnerability is rated at CVSS 7.1 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L). 

### Impact
It is possible for a malicious user who has authorization to log into a Grafana instance via a configured OAuth IdP to take over an existing Grafana account under some conditions.

### Affected versions with HIGH severity 
All Grafana >=5.3 versions are affected by this vulnerability.

### Solutions and mitigations

All installations after Grafana v5.3 should be upgraded as soon as possible.

As a workaround it is possible to [disable any OAuth login](https://grafana.com/docs/grafana/latest/setup-grafana/configure-security/configure-authentication/generic-oauth/) or ensure that all users authorized to log in via OAuth have a corresponding user account in Grafana linked to their email address.

Appropriate patches have been applied to [Grafana Cloud](https://grafana.com/cloud) and as always, we closely coordinated with all cloud providers licensed to offer Grafana Pro. They have received early notification under embargo and confirmed that their offerings are secure at the time of this announcement. This is applicable to Amazon Managed Grafana.

### Timeline

Here is a detailed timeline starting from when we originally learned of the issue. All times in UTC.

2022-06-27 19:00 - Research submission of vulnerability report
2022-06-27 20:53 - Issue triaged, confirmed positive, and internal incident raised
2022-06-28 08:42 - Fix PR submitted and reviewed
2022-06-28 20:58 - All Grafana Cloud hosted Grafana instances patched
2022-07-05 07:14 - Customers informed under embargo
2022-07-14 02:00 - Public release

### Acknowledgement

We would like to thank the HTTPVoid team for responsibly disclosing