Bugzilla – Bug 1216309
VUL-0: CVE-2023-45683: grafana: github.com/crewjam/saml: XSS via missing Binding syntax validation
Last modified: 2024-01-24 16:36:55 UTC
Impact The package does not validate the ACS Location URI according to the SAML binding being parsed. If abused, this flaw allows attackers to register malicious Service Providers at the IdP and inject Javascript in the ACS endpoint definition, achieving Cross-Site-Scripting (XSS) in the IdP context during the redirection at the end of a SAML SSO Flow. Consequently, an attacker may perform any authenticated action as the victim once the victim’s browser loaded the SAML IdP initiated SSO link for the malicious service provider. Note: The severity is considered “High” because the SP registration is commonly an unrestricted operation in IdPs, hence not requiring particular permissions or publicly accessible to ease the IdP interoperability. Patches This issue is fixed in 0.4.14 Workarounds Users of the package can perform external validation of URLs provided in SAML metadata, or restrict the ability for end-users to upload arbitrary metadata. References: https://github.com/crewjam/saml/security/advisories/GHSA-267v-3v32-g6q5 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-45683 References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-45683
Vulnerable versions of crewjam/saml are embedded in: - SUSE:SLE-12-SP3:Update:Products:Cloud8:Update/grafana - SUSE:SLE-12-SP4:Update:Products:Cloud9:Update/grafana - SUSE:SLE-12:Update/grafana - SUSE:SLE-15:Update/grafana - SUSE:SLE-15-SP2:Update/grafana - openSUSE:Factory/grafana and also SUMA codestreams: - SUSE:SLE-12:Update:Products:ManagerToolsBeta:Update/grafana - SUSE:SLE-15:Update:Products:ManagerToolsBeta:Update/grafana
(In reply to Gabriele Sonnu from comment #1) > Vulnerable versions of crewjam/saml are embedded in: > > - SUSE:SLE-12-SP3:Update:Products:Cloud8:Update/grafana > - SUSE:SLE-12-SP4:Update:Products:Cloud9:Update/grafana > - SUSE:SLE-12:Update/grafana > - SUSE:SLE-15:Update/grafana > - SUSE:SLE-15-SP2:Update/grafana > - openSUSE:Factory/grafana > > and also SUMA codestreams: > > - SUSE:SLE-12:Update:Products:ManagerToolsBeta:Update/grafana > - SUSE:SLE-15:Update:Products:ManagerToolsBeta:Update/grafana As already mentioned, please ignore the Beta codestreams. Those are used only while developing the new SUMA version.
Submitted PR to Grafana fork of the affected package: https://github.com/grafana/saml/pull/34 According to private communication Grafana "team came to the conclusion that the security vulnerability is not exploitable for our [Grafana] usage of SAMLs crewjam." The same should get confirmed by the developers on the PR soon.
Checked it once again. SAML authentication is provided in Grafana Enterprise only. https://grafana.com/docs/grafana/latest/setup-grafana/configure-security/configure-authentication/saml/ Our products are not affected.
Closing