CVE-2023-0507: Grafana GeoMap: stored XSS enables Editor-to-Admin escalation

HIGH

Published March 1, 2023

CISO Take

CVE-2023-0507 is a stored cross-site scripting flaw in Grafana's GeoMap panel, where unsanitized map attributions let an Editor-role user plant JavaScript that runs in the browser of anyone viewing the dashboard. The practical risk is vertical privilege escalation: if an Admin opens the poisoned dashboard, the script can change the Admin's password and hand over full control of the Grafana instance. Exploitation likelihood looks modest, since EPSS is unavailable, the CVE is not in CISA KEV, and there is no public exploit or Nuclei template, but the CVSS of 7.3 and the low attack complexity still make it worth fixing. The AI relevance is indirect: Grafana is widely used as the dashboard layer for ML monitoring, GPU and inference metrics, and MLOps telemetry. Upgrade to 8.5.21, 9.2.13, 9.3.8 or later, and review who holds the Editor role on dashboards that Admins routinely open.

Sources:NVDATLASgrafana.comsecurity.netapp.com

What is the risk?

Medium-high. CVSS 7.3 (AV:N/AC:L/PR:L/UI:R). Exploitation needs an authenticated Editor account and an Admin (or other higher-privileged user) to view the poisoned dashboard. There is no KEV listing, no public exploit and no scanner template, and EPSS is unavailable, so there is no evidence of active exploitation. Impact on confidentiality and integrity is high: an attacker can take over Admin accounts. The risk grows in organizations that hand out Editor roles broadly or share Grafana across teams.

How does the attack unfold?

Initial Access

Attacker uses a legitimate or compromised Editor account to access the Grafana instance.

AML.T0012

Payload Injection

Attacker edits a GeoMap panel and stores JavaScript in the map attribution field.

AML.T0049

Privilege Escalation

An Admin views the dashboard, the script runs in their session and changes the Admin password to a known value.

Impact

Attacker gains Admin control, can read data source credentials and tamper with ML monitoring dashboards.

Initial Access

Attacker uses a legitimate or compromised Editor account to access the Grafana instance.

AML.T0012

Payload Injection

Attacker edits a GeoMap panel and stores JavaScript in the map attribution field.

AML.T0049

Privilege Escalation

An Admin views the dashboard, the script runs in their session and changes the Admin password to a known value.

Impact

Attacker gains Admin control, can read data source credentials and tamper with ML monitoring dashboards.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Grafana	—	—	No patch
Grafana Enterprise	—	—	No patch

How severe is it?

CVSS 3.1

7.3 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRLow

UIRequired

SUnchanged

CHigh

IHigh

ANone

What should I do?

1 step

1) Upgrade to Grafana 8.5.21, 9.2.13, 9.3.8 or later. 2) Until patched, restrict the Editor role to trusted users and disable or avoid GeoMap panels where possible. 3) Audit existing dashboards for GeoMap panels with unusual attribution fields containing script tags or event handlers. 4) Review audit logs for unexpected password changes, new API keys or service accounts for Admin users. 5) Enforce a strict Content Security Policy in front of Grafana to limit inline script execution. 6) Rotate data source credentials if there is any sign of Admin compromise. 7) Use SSO with MFA and separate Admin accounts from day-to-day viewing accounts.

How is it classified?

Auth BypassData LeakageFrameworkPluginAML.T0012- Valid Accounts AML.T0049- Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 4.1-Post-deployment AI system monitoring

Frequently Asked Questions

What is CVE-2023-0507?

Is CVE-2023-0507 actively exploited?

No confirmed active exploitation of CVE-2023-0507 has been reported, but organizations should still patch proactively.

How to fix CVE-2023-0507?

1) Upgrade to Grafana 8.5.21, 9.2.13, 9.3.8 or later. 2) Until patched, restrict the Editor role to trusted users and disable or avoid GeoMap panels where possible. 3) Audit existing dashboards for GeoMap panels with unusual attribution fields containing script tags or event handlers. 4) Review audit logs for unexpected password changes, new API keys or service accounts for Admin users. 5) Enforce a strict Content Security Policy in front of Grafana to limit inline script execution. 6) Rotate data source credentials if there is any sign of Admin compromise. 7) Use SSO with MFA and separate Admin accounts from day-to-day viewing accounts.

What systems are affected by CVE-2023-0507?

This vulnerability affects the following AI/ML architecture patterns: ML monitoring and observability dashboards, model serving telemetry, MLOps platforms, training pipeline monitoring.

What is the CVSS score for CVE-2023-0507?

CVE-2023-0507 has a CVSS v3.1 base score of 7.3 (HIGH).

What is the AI security impact?

Affected AI Architectures

ML monitoring and observability dashboardsmodel serving telemetryMLOps platformstraining pipeline monitoring

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0049Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 4.1

What are the technical details?

Original Advisory

Grafana is an open-source platform for monitoring and observability. Starting with the 8.1 branch, Grafana had a stored XSS vulnerability affecting the core plugin GeoMap. The stored XSS vulnerability was possible due to map attributions weren't properly sanitized and allowed arbitrary JavaScript to be executed in the context of the currently authorized user of the Grafana instance. An attacker needs to have the Editor role in order to change a panel to include a map attribution containing JavaScript. This means that vertical privilege escalation is possible, where a user with Editor role can change to a known password for a user having Admin role if the user with Admin role executes malicious JavaScript viewing a dashboard. Users may upgrade to version 8.5.21, 9.2.13 and 9.3.8 to receive a fix.

Exploitation Scenario

An attacker with a compromised Editor account on a shared ML observability Grafana edits a GeoMap panel on a popular model-serving dashboard and sets the map attribution to a payload containing JavaScript. When an Admin opens the dashboard to check inference health, the script runs with the Admin's session and changes the Admin password to an attacker-known value. The attacker logs in as Admin, reads data source configurations holding credentials for the metrics store and cloud services behind the ML platform, and uses them to reach the wider MLOps environment or to tamper with monitoring dashboards and hide malicious activity.

Weaknesses (CWE)

CWE-79Improper Neutralization of Input During Web Page Generation

CWE-79 — Improper Neutralization of Input During Web Page Generation: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. Examples of libraries and frameworks that make it easier to generate properly encoded output include Microsoft's Anti-XSS library, the OWASP ESAPI Encoding module, and Apache Wicket.
[Implementation, Architecture and Design] Understand the context in which your data will be used and the encoding that will be expected. This is especially important when transmitting data between different components, or when generating outputs that can contain multiple encodings at the same time, such as web pages or multi-part mail messages. Study all expected communication protocols and data representations to determine the required encoding strategies. For any data that will be output to another web page, especially any data that was received from external inputs, use the appropriate encoding on all non-alphanumeric characters. Parts of the same output document may require different encodings, which will vary depending on whether the output is in the: etc. Note that HTML Entity Encoding is only appropriate for the HTML body. Consult the XSS Prevention Cheat Sheet [REF-724] for more details on the types of encoding and escaping that are needed. HTML body Element attributes (such as src="XYZ") URIs JavaScript sections Casca

Source: MITRE CWE corpus.