From be023a10fdfefd974948c2f1f0010bd0ff3e829d Mon Sep 17 00:00:00 2001 From: "grafana-delivery-bot[bot]" <132647405+grafana-delivery-bot[bot]@users.noreply.github.com> Date: Fri, 27 Sep 2024 14:53:20 -0500 Subject: [PATCH] [v11.0.x] Alerting: Fix incorrect permission on POST external rule groups endpoint [CVE-2024-8118] (#93949) Alerting: Fix incorrect permission on POST external rule groups endpoint [CVE-2024-8118] (#93940) Fix endpoint permission on rule write endpoint (cherry picked from commit c2799b4901d39515a988de0756b60a260c89e16b) Co-authored-by: Alexander Weaver --- pkg/services/ngalert/api/authorization.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkg/services/ngalert/api/authorization.go b/pkg/services/ngalert/api/authorization.go index 80565745d26..fd1462f6884 100644 --- a/pkg/services/ngalert/api/authorization.go +++ b/pkg/services/ngalert/api/authorization.go @@ -107,7 +107,7 @@ func (api *API) authorize(method, path string) web.Handler { case http.MethodGet + "/api/ruler/{DatasourceUID}/api/v1/rules": eval = ac.EvalPermission(ac.ActionAlertingRuleExternalRead, datasources.ScopeProvider.GetResourceScopeUID(ac.Parameter(":DatasourceUID"))) case http.MethodPost + "/api/ruler/{DatasourceUID}/api/v1/rules/{Namespace}": - eval = ac.EvalPermission(ac.ActionAlertingInstancesExternalWrite, datasources.ScopeProvider.GetResourceScopeUID(ac.Parameter(":DatasourceUID"))) + eval = ac.EvalPermission(ac.ActionAlertingRuleExternalWrite, datasources.ScopeProvider.GetResourceScopeUID(ac.Parameter(":DatasourceUID"))) // Lotex Prometheus-compatible Paths case http.MethodGet + "/api/prometheus/{DatasourceUID}/api/v1/rules":