CVE-2023-3128: Grafana Auth Bypass Vulnerability

CVE-2023-3128 Overview

CVE-2023-3128 is a critical authentication bypass vulnerability affecting Grafana when configured with Azure Active Directory (Azure AD) OAuth in multi-tenant environments. The vulnerability stems from Grafana's improper validation of Azure AD accounts, relying on the email claim field for authentication—a field that is neither unique nor immutable within Azure AD.

An attacker who can modify their Azure AD profile email field to match a legitimate Grafana user's email address can effectively impersonate that user, leading to complete account takeover. This is particularly severe in multi-tenant Azure AD configurations where multiple organizations share the same Grafana instance.

Critical Impact

This authentication bypass allows unauthenticated attackers to completely take over any Grafana user account, including administrator accounts, when Azure AD OAuth is configured with a multi-tenant application.

Affected Products

• Grafana (Open Source Edition)
• Grafana Enterprise Edition
• All versions using Azure AD OAuth with multi-tenant configuration

Discovery Timeline

• 2023-06-22 - CVE-2023-3128 published to NVD
• 2025-02-13 - Last updated in NVD database

Technical Details for CVE-2023-3128

Vulnerability Analysis

The core issue lies in how Grafana authenticates users through Azure AD OAuth. When a user authenticates, Grafana extracts the email claim from the Azure AD token and uses it as the primary identifier for user lookup or creation. However, the email field in Azure AD user profiles has two critical characteristics that make it unsuitable for authentication: it is not unique across the directory, and users with appropriate permissions can modify their own email addresses.

In multi-tenant Azure AD configurations, this problem is amplified. An attacker from any tenant within the Azure AD ecosystem can create or modify their profile email to match a target user's email in Grafana. When the attacker authenticates through the Azure AD OAuth flow, Grafana trusts the email claim and grants access to the account associated with that email address.

This vulnerability is classified under CWE-290 (Authentication Bypass by Spoofing), as it allows an attacker to circumvent the authentication mechanism by spoofing their identity through a mutable, non-unique identifier.

Root Cause

The root cause is Grafana's trust in the email claim from Azure AD tokens without additional verification. The OAuth implementation assumes that the email field is a reliable, unique identifier—an assumption that does not hold true in Azure AD environments. Proper OAuth implementations should rely on immutable, guaranteed-unique identifiers such as the oid (Object ID) or sub (Subject) claims rather than user-modifiable attributes like email addresses.

Attack Vector

The attack is network-based and requires no privileges or user interaction, making it highly accessible to remote attackers. The attack flow proceeds as follows:

1. The attacker identifies a target Grafana instance using Azure AD OAuth with multi-tenant configuration
2. The attacker determines or guesses the email address of a privileged Grafana user (e.g., an administrator)
3. The attacker modifies their own Azure AD profile email to match the target's email address
4. The attacker initiates the Azure AD OAuth login flow on the target Grafana instance
5. Azure AD authenticates the attacker and returns a token containing the spoofed email in the email claim
6. Grafana validates the token and looks up the user based on the email claim
7. Grafana grants the attacker access to the victim's account

The attack is particularly dangerous because it requires no exploitation of software bugs in the traditional sense—it merely abuses the design flaw in how Grafana validates user identity.

Detection Methods for CVE-2023-3128

Indicators of Compromise

• Multiple authentication events for the same Grafana account originating from different Azure AD tenants or user object IDs
• User account activity from unexpected geographic locations or IP addresses following an Azure AD OAuth login
• Sudden changes in user permissions or dashboard configurations after OAuth authentication events
• Authentication logs showing email address changes in Azure AD shortly before Grafana login attempts

Detection Strategies

• Implement logging that captures the full Azure AD token claims, including oid, tid (tenant ID), and email, for correlation analysis
• Create alerts for Grafana logins where the Azure AD tenant ID does not match expected organizational tenants
• Monitor for discrepancies between the Azure AD oid and previously recorded object IDs for existing user accounts
• Deploy SIEM rules to detect rapid successive logins from the same email address but different source characteristics

Monitoring Recommendations

• Enable detailed authentication logging in Grafana to capture OAuth claim information
• Configure Azure AD sign-in logs to alert on email profile modifications followed by third-party application access
• Implement user behavior analytics to detect anomalous account activity post-authentication
• Review Grafana access logs regularly for signs of unauthorized administrative actions

How to Mitigate CVE-2023-3128

Immediate Actions Required

• Upgrade Grafana to a patched version immediately if using Azure AD OAuth with multi-tenant configuration
• Restrict Azure AD OAuth configuration to single-tenant mode if multi-tenant is not required
• Audit recent authentication logs for signs of account compromise
• Review and revoke any suspicious API keys or sessions created during the exposure window

Patch Information

Grafana has released security patches to address this vulnerability. Organizations should update to the latest patched versions as detailed in the Grafana Security Advisory. The patch modifies the authentication logic to use more reliable Azure AD claims for user identification rather than the mutable email field.

Additional advisory information is available from:

• GitHub Security Advisory GHSA-gxh2-6vvc-rrgp
• NetApp Security Advisory

Workarounds

• Configure the allowed_domains setting in Grafana to restrict authentication to specific email domains
• Switch to single-tenant Azure AD application registration to limit the scope of potential attackers
• Implement additional authentication factors or conditional access policies in Azure AD before accessing Grafana
• Use Azure AD groups with the allowed_groups setting to restrict which users can authenticate to Grafana

# Example Grafana configuration to restrict OAuth domains and groups
[auth.azuread]
enabled = true
allow_sign_up = false
allowed_domains = yourdomain.com
allowed_groups = grafana-users,grafana-admins