Hi Team, In Below example, how can restrict only select query in “rawSql” parameter? Now i can able to append any Sql query like drop, insert, delete and select. this is kind of injection.need to avoid this. how to make only read (means SELECT)? POST /api/tsdb/query HTTP/1.1 Accept: applicatio…

It is mentioned in the doc. For example for PostgreSQL datasource: Database User Permissions (Important!) The database user you specify when you add the data source should only be granted SELECT permissions on the specified database and tables you want to query. Grafana does not validate that the…

even set a read-only permission. The hacker can query what they want inside the database. Why need to pass the rawSQL as a request. it is a common sense of sql injection. Don’t simply put the responsibility to database admin

I agree with leochan, creating a user is not a proper solution because even if with only SELECT permissions, users can still wreck havoc in your database. What if they use SELECT count(*) FROM users WHERE username = 'a' AND password = 'b'; as a way to brute force accounts? This makes Grafana a stupi…

[image] mrpowergamerbr: I’m pretty sure there isn’t any reason to keep the query on the client side. There is a reason: some datasources can by queried from the browser (they support also client mode, not just server mode). I don’t understand why paranoid SQL users don’t solve it on the db l…

I don’t understand why paranoid SQL users don’t solve it on the db level - create views, materialized views, whatever used DB provides and let Grafana user to access only those and not tables directly. Then try solving the issue that users can still create malicious queries to grind your SQL serv…

Grafana 9.1 has a new feature that allows you to create Public Dashboards without allowing users to inject arbitrary queries! [image] Grafana 9.1 release: New Grafana panels, RBAC for plugins, public dashboards,... The Grafana 9.1 release includes improvements to Grafana's usability, da…

This is great - i’ve had a look at the request sent on influx/sqlite/postgres and none has query to the DB - thanks a lot for pointing this out!

You mean the user not able to see the raw query ?

SQL injection in /api/tsdb/query in grafana

mrpowergamerbr August 17, 2022, 4:32pm 7

Grafana 9.1 has a new feature that allows you to create Public Dashboards without allowing users to inject arbitrary queries!

Topic		Replies	Views
Avoid SQL injection when tampering with the queries Dashboards	3	1768	September 7, 2023
Handling SQL injection in Grafana URL Queries to Influxdb? Grafana	6	3172	March 5, 2020
How to avoid sql injection in Grafana Configuration	1	2325	November 20, 2021
It's Grafana vulnerable to SQL Injection Grafana api , query-help	2	1064	October 24, 2023
Dashboard variable sql injection PostgreSQL postgres	1	3738	October 30, 2018

SQL injection in /api/tsdb/query in grafana

Related topics