Grafana before 7.1.0-beta 1 allows XSS via a query alias for the ElasticSearch datasource. The problem is caused by the bs-typeahead directive which evals the select options passed to it. We are using an old version of ng-strap which allows only an array of strings to be passed as available options. The alias in Elastic and TestData query editor allows providing special characters, so, for instance, specifying alias as <img src onerror="alert(document.cookie)"> creates a possible XSS attack vector. Links ----- https://nvd.nist.gov/vuln/detail/CVE-2020-24303 https://github.com/grafana/grafana/blob/master/CHANGELOG.md#710-beta-1-2020-07-01 Reproducible: Always
Repository is clean, all done!
