Perses vulnerabilities

Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-beta.3, an authenticated user with viewer access to one project can supply another project through the project query parameter on project-scoped list endpoints, including /api/v1/projects/{project}/dashboards and /api/v1/datasources. The request-controlled project value is used to select dashboards, datasources, and variables without enforcing the caller's authorization for that selected project.

Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-rc.0, list endpoints used with the file-system database bind the request-controlled project query parameter into the resource Query structure without validating it against directory traversal characters, and the resulting project value is used to select database paths. An authenticated attacker can supply directory traversal segments to leave the intended project directory, read arbitrary YAML or JSON files accessible to the Perses process, and bypass project isolation.

Perses versions 0.43.0 through 0.54.0-rc.0 authorize datasource creation and unsaved datasource proxy paths on a Datasource or GlobalDatasource scope without requiring read permission for the separately grantable associated project or global Secret. A low-privilege user can attach a Secret they cannot read, point the datasource at a user-controlled service, and cause Perses to send the decrypted secret in plaintext, bypassing scope separation.