Grafana Infinity Datasource Plugin URL Restriction Bypass Vulnerability

A vulnerability in the Grafana Infinity datasource plugin allows attackers to bypass URL restrictions. The plugin, which visualizes data from various endpoints, could be configured to allow only certain URLs. However, an attacker could exploit this by using a specially crafted URL to bypass the restrictions. This issue affects versions of the Infinity datasource plugin prior to 3.4.1.

Impact

Exploitation of this vulnerability could lead to server-side request forgery (SSRF) attacks, allowing attackers to make requests to internal services or resources.

Remediation

Users can upgrade to Grafana Infinity Datasource Plugin version 3.4.1 or later to address this vulnerability.