XYZ Tile Layer XSS in Grafana Geomap Panel

Executive Summary

This vulnerability exists in the geomap panel's XYZ tile layer due to an ordering bug in how text sanitization and interpolation are handled. Specifically, the function sanitizeTextPanelContent() is applied to the raw template string before the variable substitution occurs via getTemplateSrv().replace(). Because the substitution uses a glob format without HTML escaping, malicious code can be injected. This code is then passed to OpenLayers through element.innerHTML, allowing an Editor to set a textbox variable's default value to an XSS payload. This payload executes for every user who opens the dashboard, effectively bypassing a previous fix (CVE-2023-0507).

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to a Cross-Site Scripting (XSS) attack, where an attacker can execute malicious scripts in the context of the affected application. Since the payload executes for every user who opens the dashboard, it can compromise user data, steal session tokens, or perform unauthorized actions on behalf of users. The CVSS score of 7.3 indicates a high severity with potential for significant confidentiality and integrity impact, although availability is not affected.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows an attacker with Editor privileges to inject a cross-site scripting (XSS) payload that executes for every user who opens the affected dashboard. Such an XSS vulnerability can lead to unauthorized access to sensitive information, session hijacking, or other malicious actions that compromise data confidentiality and integrity.

Because of the potential for unauthorized data exposure and manipulation, this vulnerability could negatively impact compliance with data protection regulations such as GDPR and HIPAA, which require safeguarding personal and sensitive information against unauthorized access and ensuring system security.

Useful 0 Not Useful 0