Grafana has Broken Access Control in Alert manager: Viewer can send test alerts
Date: 2023-06
Affected: go/github.com/grafana/grafana, go/github.com/grafana/grafana, go/github.com/grafana/grafana
Attack vector: xss
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2023-2183
CWE: CWE-284
CVSS: 4.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N)

### Summary Grafana allows an attacker in the Viewer role, send alerts by API Alert - Test. The option is not available from the user panel UI for in the Viewer role. **Reason for the error**: The API does not check access to this function and allows it by users with the least rights, for example, the Viewer that does not see this option in the user panel. This enables malicious users to abuse the functionality by sending multiple alert messages (e-mail, slack, etc…), spamming users, prepare Phishing attack or blocked SMTP server / IP and automatically moved all message to spam folder, add to black list IP. ### Details The logged-in user, in the Viewer role, in the user panel, does not have access to the test option of sending an e-mail alert. View of the panel for the user in the Viewer role: ![image](https://user-images.githubusercontent.com/1643385/232904030-e8a8338d-f5e3-4b04-80c3-32f2164a190e.png) Admin role - View panel for admin role: ![image](https://user-images.githubusercontent.com/1643385/232904264-c7aba0a5-0642-496b-998d-d500eb5ead7f.png) Admin role - Next step – editing: ![image](https://user-images.githubusercontent.com/1643385/232904388-ef2ee69e-3ee3-41a9-8687-305886c5c0b9.png) Admin role - Additional options: ![image](https://user-images.githubusercontent.com/1643385/232904480-dd493d34-d66d-47af-ab4f-3273ae8976bc.png) ### PoC **HTTP Request by user in role Viewer** ``` POST /api/alertmanager/grafana/config/api/v1/receivers/test HTTP/1.1 Host: xx


Mitigations:

Architectural layers (MAESTRO):