Приложения: уязвимости стека · Страница 4

Grafana Live push endpoint allows unbounded memory allocation leading to OOM

The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or streaming request body, potentially leading to out-of-memory conditions. An authenticated user with access to the Grafana Live API can trigger this issue.

Viewer-triggered race condition in Grafana Live leads to complete server crash

A race condition in Grafana Live allows authenticated users with Viewer role to trigger a server crash by sending concurrent requests that cause a fatal map access error. This results in complete service unavailability requiring restart of the Grafana server.

Stored XSS vulnerability in the Item history/Plain text widget

The Item history widget (in Zabbix 7.0+) or the Plain text widget (in Zabbix 6.0) can execute injected JavaScript when HTML display is enabled. This can allow an attacker to perform unauthorized actions depending on which user opens a dashboard containing these widgets. The malicious JavaScript would have to come from a monitored host controlled by the attacker. Note: the Item history widget is a replacement for the Plain text widget since Zabbix 7.0.

• Обновитесь до 1:7.0.27+dfsg-1
• Обновитесь до 6.0.45
• Обновитесь до 7.0.24
• Обновитесь до 7.4.8

Agent 2 Oracle plugin TNS connection string injection via the 'service' parameter

A user able to connect to Agent 2 can inject an Oracle TNS connection string via the 'service' parameter. This can lead to Agent 2 connecting to an attacker-controlled server and leaking Oracle database credentials if they are saved in a named session.

• Обновитесь до 1:7.0.27+dfsg-1
• Обновитесь до 6.0.45
• Обновитесь до 7.0.24
• Обновитесь до 7.4.8

Stored XSS vulnerability in Host navigator widget maintenance tooltip

An authenticated (non-super) administrator can create a maintenance period with a JavaScript payload that is executed by any user that opens tooltip for that maintenance period in the Host navigator widget. This can allow the attacker to perform unauthorized actions depending on which user opens the tooltip.

• Обновитесь до 1:7.0.27+dfsg-1
• Обновитесь до 7.0.24
• Обновитесь до 7.4.8

Query resampling can cause unbounded memory allocations

A resample query can be used to trigger out-of-memory crashes in Grafana.

• Обновитесь до 11.6.14
• Обновитесь до 12.1.10
• Обновитесь до 12.2.8
• Обновитесь до 12.3.6
• Обновитесь до 12.4.2

Grafana Testdata datasource can issue unbounded memory allocations

A testdata data-source can be used to trigger out-of-memory crashes in Grafana.

• Обновитесь до 11.6.14
• Обновитесь до 12.1.10
• Обновитесь до 12.2.8
• Обновитесь до 12.3.6
• Обновитесь до 12.4.2

RCE on Grafana via sqlExpressions

A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE). This is enabled by a feature in Grafana (OSS), so all users are always recommended to update to avoid future attack vectors going this path. Only instances with the sqlExpressions feature toggle enabled are vulnerable. Only instances in the following version ranges are affected: - 11.6.0 (inclusive) to 11.6.14 (exclusive): 11.6.14 has the fix. 11.5 and below are not affected. - 12.0.0 (inclusive) to 12.1.10 (exclusive): 12.1.10 has the fix. 12.0 did not receive an update, as it is end-of-life. - 12.2.0 (inclusive

• Обновитесь до 11.6.14
• Обновитесь до 12.1.10
• Обновитесь до 12.2.8
• Обновитесь до 12.3.6
• Обновитесь до 12.4.2

OpenFeature evaluation API reads input data with no bounds

The OpenFeature feature toggle evaluation endpoint reads unbounded values into memory, which can cause out-of-memory crashes.

• Обновитесь до v12.1.10
• Обновитесь до v12.2.8
• Обновитесь до v12.3.6
• Обновитесь до v12.4.2

Public dashboards discloses all direct mode datasources

When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards. No passwords of proxied data-sources are exposed. We encourage all direct data-sources to be converted to proxied data-sources as far as possible to improve your deployments' security.

• Обновитесь до 11.6.14
• Обновитесь до 12.1.10
• Обновитесь до 12.2.8
• Обновитесь до 12.3.6
• Обновитесь до 12.4.2

Missing Protected-field Authorization in Provisioning Contact Points API

A vulnerability has been discovered in Grafana OSS where an authorization bypass in the provisioning contact points API allows users with Editor role to modify protected webhook URLs without the required alert.notifications.receivers.protected:write permission.

• Обновитесь до 11.6.14
• Обновитесь до 12.1.10
• Обновитесь до 12.2.8
• Обновитесь до 12.3.6

Grafana MSSQL Data Source Plugin: Restriction Bypass Leading to OOM DoS

The Grafana MSSQL data source plugin contains a logic flaw that allows a low-privileged user (Viewer) to bypass API restrictions and trigger a catastrophic Out-Of-Memory (OOM) memory exhaustion, crashing the host container.

• Обновитесь до 11.6.14+security-01
• Обновитесь до 12.1.10+security-01
• Обновитесь до 12.2.8+security-01
• Обновитесь до 12.3.6+security-01
• Обновитесь до 12.4.2

Agent 2 Docker plugin arbitrary file read via Docker API injection

Zabbix Agent 2 Docker plugin does not properly sanitize the 'docker.container_info' parameters when forwarding them to the Docker daemon. An attacker capable of invoking Agent 2 can read arbitrary files from running Docker containers by injecting them via the Docker archive API.

• Обновитесь до 1:7.0.27+dfsg-1
• Обновитесь до 6.0.44
• Обновитесь до 7.0.23
• Обновитесь до 7.4.7

Unauthenticated arbitrary PHP class instantiation

An unauthenticated attacker can exploit the Frontend 'validate' action to blindly instantiate arbitrary PHP classes. The impact depends on environment setup but appears limited at this time.

• Обновитесь до 7.4.7

Blind, read-only SQL injection in Zabbix API via sortfield parameter

A low privilege Zabbix user with API access can exploit a blind SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL selects via the sortfield parameter. Although query results are not returned directly, an attacker can exfiltrate arbitrary database data through time-based techniques, potentially leading to session identifier disclosure and administrator account compromise.

• Обновитесь до 1:7.0.22+dfsg-1
• Обновитесь до 1:7.0.22+dfsg-1~deb13u1
• Обновитесь до 7.0.22
• Обновитесь до 7.2.15
• Обновитесь до 7.4.6

Host and event action script regex validation can be bypassed in certain situations, leading to potential command injection

Host and event action script input is validated with a regex (set by the administrator), but the validation runs in multiline mode. If ^ and $ anchors are used in user input validation, an injected newline lets authenticated users bypass the check and inject shell commands.

• Обновитесь до 1:7.0.22+dfsg-1
• Обновитесь до 1:7.0.22+dfsg-1~deb13u1
• Обновитесь до 7.0.22
• Обновитесь до 7.2.15
• Обновитесь до 7.4.6

Insufficient isolation of JavaScript (Duktape) execution context on Zabbix Server

For performance reasons Zabbix Server/Proxy reuses JavaScript (Duktape) contexts (used in script items, JavaScript reprocessing, Webhooks). This can lead to confidentiality loss where a regular (non-super) Zabbix administrator leaks data for hosts they do not have access to. A fix has been released that makes the built in Zabbix JavaScript objects read-only, but please be advised that usage of global JavaScript variables is not recommended because their content could be leaked. More information <a href='https://www.zabbix.com/documentation/7.4/en/manual/installation/known_issues#preprocessing-global-variables-are-unsafe'>in Zabbix documentati

• Обновитесь до 1:7.0.22+dfsg-1
• Обновитесь до 1:7.0.22+dfsg-1~deb13u1
• Обновитесь до 6.0.42
• Обновитесь до 7.0.19
• Обновитесь до 7.2.13
• Обновитесь до 7.4.3

Unauthorized host creation via configuration.import API by low-privilege user with write permissions

An authenticated Zabbix user (User role) with template/host write permissions is able to create objects via the configuration.import API. This can lead to confidentiality loss by creating unauthorized hosts. Note that the User role is normally not sufficient to create and edit templates/hosts even with write permissions.

• Обновитесь до 1:7.0.22+dfsg-1
• Обновитесь до 1:7.0.22+dfsg-1~deb13u1
• Обновитесь до 6.0.41
• Обновитесь до 7.0.18
• Обновитесь до 7.4.2

Authorization Bypass via TOCTOU in Grafana Datasource Deletion by Name

A time-of-create-to-time-of-use (TOCTOU) vulnerability lets recently deleted-then-recreated data sources be re-deleted without permission to do so. This requires several very stringent conditions to be met: - The attacker must have admin access to the specific datasource prior to its first deletion. - Upon deletion, all steps within the attack must happen within the next 30 seconds and on the same pod of Grafana. - The attacker must delete the datasource, then someone must recreate it. - The new datasource must not have the attacker as an admin. - The new datasource must have the same UID as the prior datasource. These are randomised by def

• Обновитесь до v12.4.1

Frontend DoS vulnerability due to asymmetric resource consumption

An authenticated Zabbix user (including Guest) is able to cause disproportionate CPU load on the webserver by sending specially crafted parameters to /imgstore.php, leading to potential denial of service.

• Обновитесь до 1:7.0.22+dfsg-1
• Обновитесь до 1:7.0.22+dfsg-1~deb13u1
• Обновитесь до 6.0.42
• Обновитесь до 7.0.19
• Обновитесь до 7.2.13
• Обновитесь до 7.4.3