Grafana Image Renderer Remote Code Execution Vulnerability

A remote code execution vulnerability has been identified in the Grafana Image Renderer plugin, versions 1.0.0 prior to 4.0.16. This vulnerability arises from an arbitrary file write issue in the '/render/csv' endpoint, which failed to properly validate the 'filePath' parameter. As a result, an attacker could save a shared object to a location of their choosing, where it would be loaded by the Chromium process. Instances are vulnerable if the default 'authToken' has not been changed or is known to the attacker, and if the attacker can access the image renderer endpoint.

Impact

Exploitation of this vulnerability allows for remote code execution on the server where Grafana Image Renderer is running.

Remediation

Users can upgrade to Grafana Image Renderer version 4.0.17 or later to address this vulnerability.