Perses
Monthly
Authenticated path traversal in Perses before 0.54.0-rc.0 allows any user holding a valid Perses account to read arbitrary YAML and JSON files accessible to the Perses process by injecting directory-traversal segments (e.g. ../) into the project query parameter of list endpoints such as /api/v1/dashboards. The flaw is conditional: it only affects instances running the file-system database backend - deployments using the SQL backend are not vulnerable and that is the vendor's stated workaround - and the impact is limited to confidentiality (file read and cross-project enumeration), with no write, integrity, or availability effect. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; the issue is fixed in 0.54.0-rc.0.
Cross-scope secret disclosure in Perses (versions 0.43.0 through 0.54.0-rc.0) allows an authenticated user holding only GlobalDatasource:create or a project-level datasource-creation right to attach a project or global Secret they are not permitted to read to a datasource they control, causing Perses to forward the decrypted secret in plaintext to an attacker-operated endpoint. Exploitation requires an account with datasource-create permission in a deployment where Datasource and Secret scopes are separately granted, plus the ability to point the datasource at attacker-controlled infrastructure; the vendor fix enforces a Secret read-permission check on both the datasource-creation service and the unsaved-datasource proxy paths, and older releases can be fully protected by creating datasources via provisioning and revoking the datasource-create right. No public exploit code has been identified at time of analysis, and there is no indication of active exploitation (CISA KEV).
Authenticated users holding only viewer rights on a single project can read the dashboards, datasources, and variables of every other project in Perses deployments prior to 0.54.0-beta.3, by overriding the project in scope with a client-supplied 'project' query parameter on project-scoped list endpoints. Exploitation requires a low-privilege authenticated account (PR:L), needs no user interaction or non-default configuration, and yields read-only cross-tenant disclosure of full resource specifications rather than any modification. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor-released fix is version 0.54.0-beta.3.
Authenticated path traversal in Perses before 0.54.0-rc.0 allows any user holding a valid Perses account to read arbitrary YAML and JSON files accessible to the Perses process by injecting directory-traversal segments (e.g. ../) into the project query parameter of list endpoints such as /api/v1/dashboards. The flaw is conditional: it only affects instances running the file-system database backend - deployments using the SQL backend are not vulnerable and that is the vendor's stated workaround - and the impact is limited to confidentiality (file read and cross-project enumeration), with no write, integrity, or availability effect. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; the issue is fixed in 0.54.0-rc.0.
Cross-scope secret disclosure in Perses (versions 0.43.0 through 0.54.0-rc.0) allows an authenticated user holding only GlobalDatasource:create or a project-level datasource-creation right to attach a project or global Secret they are not permitted to read to a datasource they control, causing Perses to forward the decrypted secret in plaintext to an attacker-operated endpoint. Exploitation requires an account with datasource-create permission in a deployment where Datasource and Secret scopes are separately granted, plus the ability to point the datasource at attacker-controlled infrastructure; the vendor fix enforces a Secret read-permission check on both the datasource-creation service and the unsaved-datasource proxy paths, and older releases can be fully protected by creating datasources via provisioning and revoking the datasource-create right. No public exploit code has been identified at time of analysis, and there is no indication of active exploitation (CISA KEV).
Authenticated users holding only viewer rights on a single project can read the dashboards, datasources, and variables of every other project in Perses deployments prior to 0.54.0-beta.3, by overriding the project in scope with a client-supplied 'project' query parameter on project-scoped list endpoints. Exploitation requires a low-privilege authenticated account (PR:L), needs no user interaction or non-default configuration, and yields read-only cross-tenant disclosure of full resource specifications rather than any modification. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor-released fix is version 0.54.0-beta.3.