CVE-2022-29170: 
Grafana vulnerability analysis and mitigation

Grafana Enterprise versions from 7.4.0-beta1 through 8.5.2 are affected by a server-side request forgery (SSRF) vulnerability (CVE-2022-29170) that allows bypassing datasource network restrictions via HTTP redirects. The vulnerability was discovered during an internal security audit on May 2, 2022, and was publicly disclosed on May 19, 2022. This vulnerability only impacts Grafana Enterprise installations when the Request security allow list feature is configured and there is a possibility to add custom datasources that return HTTP redirects (Grafana Advisory).

The vulnerability exists in Grafana Enterprise's Request security feature, which allows administrators to configure the instance to restrict calls to specific hosts through allow lists or deny lists. When a malicious datasource running on an allowed host returns HTTP redirects to a forbidden host, Grafana would blindly follow these redirects, effectively bypassing the configured security restrictions. The vulnerability has been assigned a CVSS score of 6.6 (MODERATE) with the vector CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:L (Grafana Advisory).

When successfully exploited, this vulnerability could lead to the disclosure of sensitive information by allowing attackers to bypass network restrictions and potentially access forbidden hosts. The impact is limited to Grafana Enterprise installations where the Request security allow list feature is used and custom datasources can be added. Grafana Cloud and other cloud-hosted versions are not affected by this vulnerability (Grafana Advisory).

Exploitation of this vulnerability requires three specific conditions to be met: 1) Running Grafana Enterprise 7.4.0-beta1 through 8.5.2, 2) Request security allow list feature is configured with at least one host_allow_list or host_deny_list, and 3) The ability to add a custom datasource to Grafana which returns HTTP redirects (Security Online).

The vulnerability has been patched in Grafana Enterprise versions 7.5.16 and 8.5.3. All affected installations should be upgraded to these versions or later as soon as possible. There are no known workarounds for this vulnerability. Grafana Labs coordinated with cloud providers licensed to offer Grafana Pro, including Amazon Managed Grafana and Azure's Grafana as a service offering, to ensure their offerings were secure at the time of the announcement (Grafana Advisory).