The Volkov Labs Business Links panel for Grafana provides an interface to navigate using external links, internal dashboards, time pickers, and dropdown menus. Prior to version 2.4.0, a malicious actor with Editor privileges can escalate their privileges to Administrator and perform arbitrary administrative actions. This is possible because the plugin allows arbitrary JavaScript code injection in the [Layout] → [Link] → [URL] field. Version 2.4.0 contains a fix for the issue.
In versions prior to 2.4.0, the Business Links plugin does not sanitize values entered in the [Layout] → [Link] → [URL] field. A user with Editor role can place arbitrary JavaScript code there, which will be executed in the victim's browser (e.g., an Administrator) when the link is clicked or displayed. The XSS mechanism (CWE-79, CWE-83) allows session hijacking or execution of privileged administrative operations in the context of the attacked user.
An attacker with Editor privileges can escalate their permissions to Administrator level and perform arbitrary administrative actions in the Grafana instance, including modifying configuration, accessing data, and managing users.
Update the Volkov Labs Business Links plugin to version 2.4.0, which contains a fix that eliminates the possibility of JavaScript code injection in the URL field. The patch is available in the project's GitHub repository (commit 9d203a6950de7860e11b25e4265ed8fe60082d7d).
Volkov Labs Business Links plugin for Grafana in all versions before 2.4.0
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H