CVE-2023-5123 in grafana-json-datasource
Summary
by MITRE • 02/14/2024
The JSON datasource plugin ( https://grafana.com/grafana/plugins/marcusolsson-json-datasource/ ) is a Grafana Labs maintained plugin for Grafana that allows for retrieving and processing JSON data from a remote endpoint (including a specific sub-path) configured by an administrator. Due to inadequate sanitization of the dashboard-supplied path parameter, it was possible to include path traversal characters (../) in the path parameter and send requests to paths on the configured endpoint outside the configured sub-path.
This means that if the datasource was configured by an administrator to point at some sub-path of a domain (e.g. https://example.com/api/some_safe_api/ ), it was possible for an editor to create a dashboard referencing the datasource which issues queries containing path traversal characters, which would in turn cause the datasource to instead query arbitrary subpaths on the configured domain (e.g. https://example.com/api/admin_api/) .
In the rare case that this plugin is configured by an administrator to point back at the Grafana instance itself, this vulnerability becomes considerably more severe, as an administrator browsing a maliciously configured panel could be compelled to make requests to Grafana administrative API endpoints with their credentials, resulting in the potential for privilege escalation, hence the high score for this vulnerability.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 12/23/2025
The JSON datasource plugin for Grafana presents a critical path traversal vulnerability that fundamentally undermines the security boundaries established by administrators. This vulnerability stems from insufficient input validation and sanitization of the path parameter within the plugin's configuration, allowing malicious actors to manipulate query parameters and bypass intended access controls. The flaw specifically affects how the plugin handles relative path references, enabling attackers to include traversal sequences such as '../' in their dashboard configurations. When combined with proper administrative privileges, this vulnerability creates a pathway for privilege escalation through the exploitation of the plugin's ability to make HTTP requests to configured endpoints. The security implications extend beyond simple data access, as the vulnerability can be leveraged to target internal systems that are normally protected by network segmentation and access controls.
The technical exploitation of this vulnerability follows a well-defined pattern that aligns with common path traversal attack vectors documented in CWE-22. An administrator configures the plugin to point to a specific sub-path of a domain, establishing a security boundary for data access. However, the lack of proper sanitization allows a malicious dashboard editor to construct queries that include path traversal sequences, effectively enabling access to resources outside the intended scope. This vulnerability particularly affects the plugin's request handling mechanism where the path parameter is directly incorporated into HTTP requests without adequate validation. The attack vector becomes more severe when the plugin is configured to point back at the Grafana instance itself, as this scenario enables attackers to craft malicious dashboard panels that can make requests to administrative endpoints using the credentials of users who view those panels.
The operational impact of this vulnerability spans multiple security domains and can result in significant data breaches and privilege escalation attacks. When an attacker successfully exploits this vulnerability, they can access sensitive administrative endpoints that should normally be restricted to authorized personnel only. This capability enables the compromise of administrative functions, potentially leading to complete system takeover. The severity is amplified because the vulnerability requires minimal privileges to exploit, as dashboard editors can often create malicious panels without requiring administrative access. The attack surface is further expanded when the plugin is configured to interact with internal services, as it can potentially traverse network boundaries that should normally be protected. This vulnerability directly relates to ATT&CK technique T1078.004, which covers valid accounts and T1566.002, which involves phishing with links, as attackers can craft malicious dashboards that leverage legitimate user sessions to access restricted resources.
Organizations using the affected plugin must implement immediate mitigations to protect against exploitation. The primary recommendation involves updating to the latest version of the plugin where the vulnerability has been patched through proper input sanitization and validation. Administrators should also conduct thorough audits of existing dashboard configurations to identify any potentially malicious panels that may have been created. Network segmentation and access controls should be reviewed to ensure that even if path traversal occurs, the attack surface remains limited. The implementation of proper input validation and the principle of least privilege for dashboard editors can significantly reduce the risk of exploitation. Additionally, monitoring for unusual patterns in HTTP requests made by the plugin can help detect potential exploitation attempts. Organizations should also consider implementing automated scanning tools to identify vulnerable configurations and ensure that all plugin components are regularly updated to address known security issues. The vulnerability serves as a reminder of the importance of validating all user-supplied inputs and maintaining strict access controls in dashboard environments where multiple users have editing capabilities.