CVE-2022-23498
📋 TL;DR
Grafana's datasource query caching feature inadvertently caches session headers, allowing authenticated users to potentially acquire other users' sessions when querying cached datasources. This affects all Grafana instances with datasource query caching enabled. The vulnerability enables session hijacking within the monitoring platform.
💻 Affected Systems
- Grafana
📦 What is this software?
Grafana by Grafana
Grafana by Grafana
Grafana by Grafana
Grafana by Grafana
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain administrative access to Grafana, potentially compromising monitoring data, creating backdoors, or pivoting to other systems.
Likely Case
Authenticated users escalate privileges or access other users' dashboards and data without authorization.
If Mitigated
Minimal impact with proper patching or caching disabled; session isolation remains intact.
🎯 Exploit Status
Exploitation requires authenticated access to Grafana and caching enabled; trivial for authenticated attackers to query cached datasources.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 9.2.10 or 9.3.4
Vendor Advisory: https://github.com/grafana/grafana/security/advisories/GHSA-2j8f-6whh-frc8
Restart Required: Yes
Instructions:
1. Backup Grafana configuration and data. 2. Upgrade to Grafana 9.2.10 (for 9.2.x) or 9.3.4 (for 9.3.x). 3. Restart Grafana service. 4. Verify version with 'grafana-server -v'.
🔧 Temporary Workarounds
Disable datasource query caching
allDisable caching for all datasources to prevent session header caching.
Edit Grafana configuration file (grafana.ini) and set [datasource] cache_enabled = false
Restart Grafana: systemctl restart grafana-server
🧯 If You Can't Patch
- Disable datasource query caching immediately via configuration.
- Restrict user access to only trusted personnel and monitor for unusual query patterns.
🔍 How to Verify
Check if Vulnerable:
Check Grafana version with 'grafana-server -v' or web interface; if version <9.2.10 or 9.3.x <9.3.4, and caching enabled, vulnerable.Check Version:
grafana-server -vVerify Fix Applied:
Confirm version is 9.2.10+ or 9.3.4+ and caching can remain enabled safely.📡 Detection & Monitoring
Log Indicators:
- Unusual session activity from same IP/user
- Multiple session creations for single user
Network Indicators:
- Repeated queries to cached datasources from unexpected users
SIEM Query:
source="grafana" AND (event="query" OR event="session") | stats count by user, datasource