Insecure Direct Object Reference (IDOR) / payload-URL UID mismatch

Proof-of-concept exploitation steps (demonstrating pre-fix behavior): Prerequisites: - Grafana instance with two data sources configured via API: - DataSource A with UID 'A' - DataSource B with UID 'B' - Admin/API key with datasource write permissions 1) Ensure both data sources exist (A and B). 2) Send a PUT request targeting the URL UID 'A' but with a payload UID of 'B': curl -X PUT 'https://grafana.example.com/api/datasources/uid/A' \ -H 'Authorization: Bearer <API_KEY>' \ -H 'Content-Type: application/json' \ -d '{ "uid": "B", "name": "Updated via mismatch (pre-fix)", "type": "prometheus", "url": "http://prometheus.example.com", "access": "proxy", "basicAuth": false }' 3) Expected (pre-fix) behavior: - The update operation uses the payload UID ('B') to locate the datasource to update. This can result in updating DataSource B while the request was aimed at URL UID 'A'. The API may respond with 200 OK, and B’s properties are changed, effectively allowing cross-resource modification. 4) Verification (pre-fix): - GET /api/datasources/uid/B and confirm B has been updated according to the payload. - GET /api/datasources/uid/A to observe that A was not (or may not be) updated by this request. 5) After the fix (this commit): - The server returns 400 when the payload UID ('B') does not match the URL UID ('A'), preventing cross-resource updates.

diff --git a/pkg/api/datasources.go b/pkg/api/datasources.go index 1bc3b3be9bc4e..0103d4b3c71b1 100644 --- a/pkg/api/datasources.go +++ b/pkg/api/datasources.go @@ -520,7 +520,12 @@ func (hs *HTTPServer) UpdateDataSourceByUID(c *contextmodel.ReqContext) response return response.Error(http.StatusBadRequest, "Failed to update datasource", err) } - ds, err := hs.getRawDataSourceByUID(c.Req.Context(), web.Params(c.Req)[":uid"], c.GetOrgID()) + urlUID := web.Params(c.Req)[":uid"] + if cmd.UID != "" && cmd.UID != urlUID { + return response.Error(http.StatusBadRequest, "UID in the payload must match the UID in the URL", nil) + } + + ds, err := hs.getRawDataSourceByUID(c.Req.Context(), urlUID, c.GetOrgID()) if err != nil { if errors.Is(err, datasources.ErrDataSourceNotFound) { return response.Error(http.StatusNotFound, "Data source not found", nil) diff --git a/pkg/api/datasources_test.go b/pkg/api/datasources_test.go index d6e0b1dc1ddd7..7281d8cf7b297 100644 --- a/pkg/api/datasources_test.go +++ b/pkg/api/datasources_test.go @@ -369,6 +369,35 @@ func TestUpdateDataSourceByID_DataSourceNameExists(t *testing.T) { require.Equal(t, http.StatusConflict, sc.resp.Code) } +func TestUpdateDataSourceByUID_UIDMismatch(t *testing.T) { + hs := &HTTPServer{ + DataSourcesService: &dataSourcesServiceMock{ + expectedDatasource: &datasources.DataSource{}, + }, + Cfg: setting.NewCfg(), + AccessControl: acimpl.ProvideAccessControl(featuremgmt.WithFeatures()), + accesscontrolService: actest.FakeService{}, + } + hs.promRegister, hs.dsConfigHandlerRequestsDuration, hs.dsEndpointRedirects = setupDsConfigHandlerMetrics() + + sc := setupScenarioContext(t, "/api/datasources/uid/url-uid") + + sc.m.Put(sc.url, routing.Wrap(func(c *contextmodel.ReqContext) response.Response { + c.Req = web.SetURLParams(c.Req, map[string]string{":uid": "url-uid"}) + c.Req.Body = mockRequestBody(datasources.UpdateDataSourceCommand{ + UID: "different-uid", + Access: "proxy", + Type: "test", + Name: "test", + }) + return hs.UpdateDataSourceByUID(c) + })) + + sc.fakeReqWithParams("PUT", sc.url, map[string]string{}).exec() + + require.Equal(t, http.StatusBadRequest, sc.resp.Code) +} + func TestAPI_datasources_AccessControl(t *testing.T) { type testCase struct { desc string diff --git a/pkg/extensions/enterprise_imports.go b/pkg/extensions/enterprise_imports.go index 9b0fa0a5b67fb..30ca114055639 100644 --- a/pkg/extensions/enterprise_imports.go +++ b/pkg/extensions/enterprise_imports.go @@ -111,6 +111,8 @@ import ( _ "github.com/grafana/grafana/apps/alerting/alertenrichment/pkg/apis/alertenrichment/v1beta1" _ "github.com/grafana/grafana/apps/alerting/historian/pkg/app/config" _ "github.com/grafana/grafana/apps/dashboard/pkg/apis/dashboard/v0alpha1" + _ "github.com/grafana/grafana/apps/dashboard/pkg/apis/dashboard/v2" + _ "github.com/grafana/grafana/apps/dashboard/pkg/apis/dashboard/v2beta1" _ "github.com/grafana/grafana/apps/dashboard/pkg/migration/schemaversion" _ "github.com/grafana/grafana/apps/folder/pkg/apis/folder/v1beta1" _ "github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1"