From 011938f60c760f3831f274023113b02a3df7b748 Mon Sep 17 00:00:00 2001 From: "grafana-delivery-bot[bot]" <132647405+grafana-delivery-bot[bot]@users.noreply.github.com> Date: Fri, 27 Sep 2024 14:59:18 -0500 Subject: [PATCH] [v10.3.x] Alerting: Fix incorrect permission on POST external rule groups endpoint [CVE-2024-8118] (#93945) Alerting: Fix incorrect permission on POST external rule groups endpoint [CVE-2024-8118] (#93940) Fix endpoint permission on rule write endpoint (cherry picked from commit c2799b4901d39515a988de0756b60a260c89e16b) Co-authored-by: Alexander Weaver --- pkg/services/ngalert/api/authorization.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkg/services/ngalert/api/authorization.go b/pkg/services/ngalert/api/authorization.go index a3d073b6236..661034fc1c6 100644 --- a/pkg/services/ngalert/api/authorization.go +++ b/pkg/services/ngalert/api/authorization.go @@ -93,7 +93,7 @@ func (api *API) authorize(method, path string) web.Handler { case http.MethodGet + "/api/ruler/{DatasourceUID}/api/v1/rules": eval = ac.EvalPermission(ac.ActionAlertingRuleExternalRead, datasources.ScopeProvider.GetResourceScopeUID(ac.Parameter(":DatasourceUID"))) case http.MethodPost + "/api/ruler/{DatasourceUID}/api/v1/rules/{Namespace}": - eval = ac.EvalPermission(ac.ActionAlertingInstancesExternalWrite, datasources.ScopeProvider.GetResourceScopeUID(ac.Parameter(":DatasourceUID"))) + eval = ac.EvalPermission(ac.ActionAlertingRuleExternalWrite, datasources.ScopeProvider.GetResourceScopeUID(ac.Parameter(":DatasourceUID"))) // Lotex Prometheus-compatible Paths case http.MethodGet + "/api/prometheus/{DatasourceUID}/api/v1/rules":