-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability exists because the DingDing alerter's webhook URL was not configured as a secure field, allowing users with Viewer permissions to access it. The provided patches address this by marking the 'url' field for the DingDing notifier as 'Secure: true' in pkg/services/ngalert/notifier/channels_config/available_channels.go. Consequently, the alertmanager.buildReceiverIntegrations function in pkg/services/ngalert/notifier/alertmanager.go was modified to handle this new secret field. A new function, patchNewSecureFields, is introduced and called from buildReceiverIntegrations to decrypt the DingDing URL before the receiver configuration is built. Without this patch, buildReceiverIntegrations would process the DingDing configuration with the sensitive URL in plaintext, making it accessible to unauthorized users. Therefore, alertmanager.buildReceiverIntegrations is the primary function that would be observed in a runtime profile during the exploitation of this vulnerability, as it is the function that handles the insecurely stored sensitive information.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/grafana/grafana | go | < 1.9.2-0.20250514160932-04111e9f2afd | 1.9.2-0.20250514160932-04111e9f2afd |