CVE-2018-1000816

Vulnerability

Grafana versions 5.2.4 and 5.3.0 are confirmed vulnerable to a cross-site scripting (XSS) flaw in the InfluxDB and Graphite query editors [2]. The vulnerability arises because user-supplied input in metric segments and SQL parts is not properly escaped before being rendered in the browser [1]. This allows an authenticated attacker to inject malicious JavaScript code into the query editor interface.

Exploitation

An attacker must be an authenticated user of the Grafana instance. The attacker inserts a crafted payload into the query editor's input field (e.g., metric name or SQL fragment). The payload is stored and later executed when another authenticated user (or the same user) clicks on that input field [2]. No additional privileges beyond authentication are required.

Impact

Successful exploitation leads to arbitrary JavaScript execution in the victim's browser within the context of the Grafana application. This can result in session hijacking, data exfiltration, or other actions performed on behalf of the victim user. The attack is limited to the browser session and does not directly affect the server.

Mitigation

The fix was implemented in pull request #13670 [1] and included in Grafana version 5.3.2 (unreleased at the time of the CVE) as noted in the changelog [4]. Users should upgrade to Grafana 5.3.2 or later. If upgrading is not immediately possible, administrators should restrict access to trusted users only, as the vulnerability requires an authenticated session. No workaround is documented.