Skip to content

Commit 27f66f2

Browse files
GeekMasherGeekMasher
committed
feat(queries): Add Grafana queries
1 parent 155f29b commit 27f66f2

18 files changed

+991
-0
lines changed

‎ql/src/security/CWE-200/GrafanaExternalSnapshotsEnabled.md

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
# External snapshots enabled in Grafana
2+
3+
This query identifies Microsoft.Dashboard/grafana resources that have external snapshots enabled, which could potentially lead to data leakage.
4+
5+
## Description
6+
7+
Grafana allows users to create and share snapshots of dashboards. When the `externalEnabled` property in the snapshots configuration is set to `true`, users can publish these snapshots to an external, public snapshot server. This means that dashboard data, which may include sensitive metrics or information, could be shared outside of your organization.
8+
9+
External snapshots are stored on a public server provided by Grafana Labs, and anyone with the link can view the snapshot. This creates a risk of sensitive data exposure if users inadvertently share snapshots containing confidential information.
10+
11+
## Recommendation
12+
13+
Unless external snapshots are specifically required for your use case, disable external snapshots by setting the `externalEnabled` property to `false`. This ensures that snapshots can only be shared internally within your Grafana instance, reducing the risk of accidental data leakage.
14+
15+
## Example of vulnerable code
16+
17+
```bicep
18+
resource vulnerableGrafana 'Microsoft.Dashboard/grafana@2024-11-01-preview' = {
19+
name: 'grafana-external-snapshots'
20+
location: 'eastus'
21+
properties: {
22+
grafanaConfigurations: {
23+
snapshots: {
24+
externalEnabled: true // Vulnerable: External snapshots are enabled
25+
}
26+
}
27+
}
28+
sku: {
29+
name: 'Standard'
30+
}
31+
}
32+
```
33+
34+
## Example of secure code
35+
36+
```bicep
37+
resource secureGrafana 'Microsoft.Dashboard/grafana@2024-11-01-preview' = {
38+
name: 'grafana-internal-snapshots'
39+
location: 'eastus'
40+
properties: {
41+
grafanaConfigurations: {
42+
snapshots: {
43+
externalEnabled: false // Secure: External snapshots are disabled
44+
}
45+
}
46+
}
47+
sku: {
48+
name: 'Standard'
49+
}
50+
}
51+
52+
// Alternative: omit the snapshots configuration block entirely to use default settings
53+
resource secureGrafanaAlt 'Microsoft.Dashboard/grafana@2024-11-01-preview' = {
54+
name: 'grafana-default-snapshots'
55+
location: 'eastus'
56+
properties: {
57+
// No explicit snapshots configuration, using defaults
58+
}
59+
sku: {
60+
name: 'Standard'
61+
}
62+
}
63+
```
64+
65+
## References
66+
67+
* [Grafana snapshot documentation](https://grafana.com/docs/grafana/latest/dashboards/share-dashboards-panels/#publish-a-snapshot)
68+
* [Azure Managed Grafana documentation](https://learn.microsoft.com/en-us/azure/managed-grafana/)
69+
* [CWE-200: Exposure of Sensitive Information to an Unauthorized Actor](https://cwe.mitre.org/data/definitions/200.html)

‎ql/src/security/CWE-200/GrafanaExternalSnapshotsEnabled.ql

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
/**
2+
* @name External snapshots enabled in Grafana
3+
* @description External snapshots in Grafana allow sharing dashboard data with external services,
4+
* which could potentially lead to data leakage.
5+
* @kind problem
6+
* @problem.severity warning
7+
* @security-severity 4.0
8+
* @precision high
9+
* @id bicep/grafana-external-snapshots-enabled
10+
* @tags security
11+
* bicep
12+
* azure
13+
* CWE-200
14+
*/
15+
16+
import bicep
17+
import codeql.bicep.frameworks.Microsoft.Dashboards
18+
19+
from Dashboards::GrafanaResource grafana,
20+
Dashboards::GrafanaProperties::Properties props,
21+
Dashboards::GrafanaProperties::GrafanaConfigurations configs,
22+
Dashboards::GrafanaProperties::Snapshots snapshots
23+
where
24+
props = grafana.getProperties() and
25+
configs = props.getGrafanaConfigurations() and
26+
snapshots = configs.getSnapshots() and
27+
snapshots.hasExternalEnabled() and
28+
snapshots.externalEnabled() = true
29+
select snapshots,
30+
"External snapshots are enabled in Grafana configuration, which could lead to " +
31+
"unintended sharing of dashboard data with external services."

‎ql/src/security/CWE-272/GrafanaExcessiveEditorPermissions.md

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
# Excessive permissions for Grafana editors
2+
3+
This query identifies Microsoft.Dashboard/grafana resources that grant administrative capabilities to editor users, which reduces the effectiveness of access control and can lead to privilege escalation.
4+
5+
## Description
6+
7+
Azure Managed Grafana supports different user roles with varying levels of permissions. The `editorsCanAdmin` property in the users configuration determines whether users with the editor role can administrate dashboards, folders, and teams they create. When set to `true`, editors gain administrative capabilities that go beyond their standard role, potentially violating the principle of least privilege.
8+
9+
This configuration can lead to unintended privilege escalation, where editors gain more control over the Grafana instance than intended. It could result in unauthorized access to sensitive data, changes to important dashboards, or modifications to team permissions.
10+
11+
## Recommendation
12+
13+
Follow the principle of least privilege by setting the `editorsCanAdmin` property to `false` or omitting it (the default is `false`). If certain users need administrative capabilities, consider granting them the admin role instead of elevating all editors' permissions.
14+
15+
## Example of vulnerable code
16+
17+
```bicep
18+
resource vulnerableGrafana 'Microsoft.Dashboard/grafana@2024-11-01-preview' = {
19+
name: 'grafana-excessive-editor-perms'
20+
location: 'eastus'
21+
properties: {
22+
grafanaConfigurations: {
23+
users: {
24+
editorsCanAdmin: true // Vulnerable: Editors have admin capabilities
25+
}
26+
}
27+
}
28+
sku: {
29+
name: 'Standard'
30+
}
31+
}
32+
```
33+
34+
## Example of secure code
35+
36+
```bicep
37+
resource secureGrafana 'Microsoft.Dashboard/grafana@2024-11-01-preview' = {
38+
name: 'grafana-proper-editor-perms'
39+
location: 'eastus'
40+
properties: {
41+
grafanaConfigurations: {
42+
users: {
43+
editorsCanAdmin: false // Secure: Editors do not have admin capabilities
44+
}
45+
}
46+
}
47+
sku: {
48+
name: 'Standard'
49+
}
50+
}
51+
52+
// Alternative: omit the editorsCanAdmin property to use default (false)
53+
resource secureGrafanaAlt 'Microsoft.Dashboard/grafana@2024-11-01-preview' = {
54+
name: 'grafana-default-editor-perms'
55+
location: 'eastus'
56+
properties: {
57+
grafanaConfigurations: {
58+
users: {
59+
// editorsCanAdmin property omitted (defaults to false)
60+
}
61+
}
62+
}
63+
sku: {
64+
name: 'Standard'
65+
}
66+
}
67+
```
68+
69+
## References
70+
71+
* [Grafana user permissions documentation](https://grafana.com/docs/grafana/latest/administration/user-management/user-roles/)
72+
* [Azure Managed Grafana documentation](https://learn.microsoft.com/en-us/azure/managed-grafana/)
73+
* [CWE-272: Least Privilege Violation](https://cwe.mitre.org/data/definitions/272.html)
74+
* [Principle of least privilege](https://en.wikipedia.org/wiki/Principle_of_least_privilege)

‎ql/src/security/CWE-272/GrafanaExcessiveEditorPermissions.ql

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
/**
2+
* @name Excessive permissions for Grafana editors
3+
* @description Granting admin permissions to editors reduces the effectiveness of access control
4+
* and can lead to privilege escalation.
5+
* @kind problem
6+
* @problem.severity warning
7+
* @security-severity 5.0
8+
* @precision high
9+
* @id bicep/grafana-excessive-editor-permissions
10+
* @tags security
11+
* bicep
12+
* azure
13+
* CWE-272
14+
*/
15+
16+
import bicep
17+
import codeql.bicep.frameworks.Microsoft.Dashboards
18+
19+
from Dashboards::GrafanaResource grafana,
20+
Dashboards::GrafanaProperties::Properties props,
21+
Dashboards::GrafanaProperties::GrafanaConfigurations configs,
22+
Dashboards::GrafanaProperties::Users users
23+
where
24+
props = grafana.getProperties() and
25+
configs = props.getGrafanaConfigurations() and
26+
users = configs.getUsers() and
27+
users.hasEditorsCanAdmin() and
28+
users.editorsCanAdmin() = true
29+
select users,
30+
"Excessive permissions granted to Grafana editors (editorsCanAdmin=true). " +
31+
"This allows editors to administrate dashboards, folders and teams they create."

‎ql/src/security/CWE-272/GrafanaExcessiveViewerPermissions.md

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
# Excessive permissions for Grafana viewers
2+
3+
This query identifies Microsoft.Dashboard/grafana resources that grant edit capabilities to viewer users, which reduces the effectiveness of access control and can lead to unauthorized changes to dashboards.
4+
5+
## Description
6+
7+
Azure Managed Grafana supports different user roles with varying levels of permissions. The `viewersCanEdit` property in the users configuration determines whether users with the viewer role can make temporary edits to dashboards they have access to. When set to `true`, viewers gain more capabilities than they typically should have based on the principle of least privilege.
8+
9+
While these edits are temporary and cannot be saved permanently, it still represents a weakening of the role-based access control model and could lead to confusion, accidental changes, or potential misuse of the dashboard data.
10+
11+
## Recommendation
12+
13+
Follow the principle of least privilege by setting the `viewersCanEdit` property to `false` or omitting it (the default is `false`). If certain users need to make edits to dashboards, consider granting them the editor role instead of giving all viewers edit capabilities.
14+
15+
## Example of vulnerable code
16+
17+
```bicep
18+
resource vulnerableGrafana 'Microsoft.Dashboard/grafana@2024-11-01-preview' = {
19+
name: 'grafana-excessive-viewer-perms'
20+
location: 'eastus'
21+
properties: {
22+
grafanaConfigurations: {
23+
users: {
24+
viewersCanEdit: true // Vulnerable: Viewers can edit dashboards
25+
}
26+
}
27+
}
28+
sku: {
29+
name: 'Standard'
30+
}
31+
}
32+
```
33+
34+
## Example of secure code
35+
36+
```bicep
37+
resource secureGrafana 'Microsoft.Dashboard/grafana@2024-11-01-preview' = {
38+
name: 'grafana-proper-viewer-perms'
39+
location: 'eastus'
40+
properties: {
41+
grafanaConfigurations: {
42+
users: {
43+
viewersCanEdit: false // Secure: Viewers cannot edit dashboards
44+
}
45+
}
46+
}
47+
sku: {
48+
name: 'Standard'
49+
}
50+
}
51+
52+
// Alternative: omit the viewersCanEdit property to use default (false)
53+
resource secureGrafanaAlt 'Microsoft.Dashboard/grafana@2024-11-01-preview' = {
54+
name: 'grafana-default-viewer-perms'
55+
location: 'eastus'
56+
properties: {
57+
grafanaConfigurations: {
58+
users: {
59+
// viewersCanEdit property omitted (defaults to false)
60+
}
61+
}
62+
}
63+
sku: {
64+
name: 'Standard'
65+
}
66+
}
67+
```
68+
69+
## References
70+
71+
* [Grafana user permissions documentation](https://grafana.com/docs/grafana/latest/administration/user-management/user-roles/)
72+
* [Azure Managed Grafana documentation](https://learn.microsoft.com/en-us/azure/managed-grafana/)
73+
* [CWE-272: Least Privilege Violation](https://cwe.mitre.org/data/definitions/272.html)
74+
* [Principle of least privilege](https://en.wikipedia.org/wiki/Principle_of_least_privilege)

‎ql/src/security/CWE-272/GrafanaExcessiveViewerPermissions.ql

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
/**
2+
* @name Excessive permissions for Grafana viewers
3+
* @description Granting edit permissions to viewers reduces the effectiveness of access control
4+
* and can lead to unauthorized changes to dashboards.
5+
* @kind problem
6+
* @problem.severity warning
7+
* @security-severity 4.0
8+
* @precision high
9+
* @id bicep/grafana-excessive-viewer-permissions
10+
* @tags security
11+
* bicep
12+
* azure
13+
* CWE-272
14+
*/
15+
16+
import bicep
17+
import codeql.bicep.frameworks.Microsoft.Dashboards
18+
19+
from Dashboards::GrafanaResource grafana,
20+
Dashboards::GrafanaProperties::Properties props,
21+
Dashboards::GrafanaProperties::GrafanaConfigurations configs,
22+
Dashboards::GrafanaProperties::Users users
23+
where
24+
props = grafana.getProperties() and
25+
configs = props.getGrafanaConfigurations() and
26+
users = configs.getUsers() and
27+
users.hasViewersCanEdit() and
28+
users.viewersCanEdit() = true
29+
select users,
30+
"Excessive permissions granted to Grafana viewers (viewersCanEdit=true). " +
31+
"This allows viewers to make temporary edits to dashboards they have access to."

0 commit comments

Comments
 (0)