I’m considering using MySQL as a data source in Grafana and have some concerns regarding the security aspects of executing business data query scripts within a panel, triggered by HTTP requests to the backend data source. Based on the frontend’s potential for tampering, I’ve identified a couple of k…

what you raise are legit concerns. seems that using relational databases like MySQL as data sources for reporting in product X introduces several security vulnerabilities the onus is on your db admin to configure security based on mysql best practices. it is not a grafana issue but more of securit…

Thank you, yes, we have configured different MySQL users for different dashboards in MySQL, and these users are restricted to accessing different tables. However, if we want to filter data within the same table based on different Grafana login accounts, I’m not sure if there is a good way to do th…

Regardless, the fact that Grafana panels support SQL script queries and pass them unencrypted to the backend for execution makes Grafana insecure. This is a serious security flaw. This issue becomes apparent when you expect different users under Grafana to see different data filtered from the same …

Actually, to fix this, Grafana could encrypt the Panel query SQL script using the login user’s token, and then decrypt it in the backend for execution. This would solve the problem.

I would say this approach won’t fix it. What is stopping me to edit SQL query in the browser - your approach will just encrypt that modified SQL and backend will decrypt and execute it. Could you show me any Grafana competitor, which has this “security issue” solved (and any doc how it is sorted),…

you can do that [image] Limit users to access Variable values Elasticsearch One way would be to query the companies data by passing in the currently logged in username. For example if ajames is in company A and dvader is in company dark side the user name, if available a…

[image] jangaraj: competitor Using global variables, such as login user association, for data isolation is ineffective. It has been verified that users can delete SQL filtering conditions and modify SQL scripts. Therefore, the fundamental solution is: in viewer mode, Solution 1, SQL should …

Sorry, I asked for competitors. What I know no competitor has implemented that. That’s because they are not designed for this. If you need it, then build own “Grafana” and you will very likely discover how complex problem is it if you want to implement it properly and not only small subset of feat…

[image] Ford2018: has been verified that users can delete SQL filtering conditions and modify SQL scripts. it has been verified with grafana? please share sources

Yes, your point is correct. Using Grafana with RDS like MySQL as data sources is not safe. It not only fails to ensure data filtering based on login users, but users can also modify SQL scripts transmitted via the browser’s web interface. Under such conditions, users can delete data tables from a…

Security Concerns When Using MySQL as a DataSource in Grafana

Grafana

yosiasz June 7, 2024, 12:07pm 7

you can do that

Topic		Replies	Views
How to set logged in User's username as a filter condition in Grafana Grafana Plugin Development	10	9477	November 18, 2022
SQL injection in /api/tsdb/query in grafana	8	9404	November 19, 2023
MySQL authentication credentails per user Configuration mysql	1	813	January 22, 2021
It's Grafana vulnerable to SQL Injection Grafana api , query-help	2	1105	October 24, 2023
Security of multi-tenancy with SQL datasource	2	452	August 15, 2019

Security Concerns When Using MySQL as a DataSource in Grafana

Related topics