Grafana Labs < 11.6.15 / 12.2.0 < 12.2.9 / 12.3.0 < 12.3.7 / 12.4.0 < 12.4.4 / 13.0.0 < 13.0.2 Multiple Vulnerabilities

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(329319);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/24");

  script_cve_id(
    "CVE-2026-10601",
    "CVE-2026-33382",
    "CVE-2026-42127",
    "CVE-2026-8609"
  );
  script_xref(name:"IAVB", value:"2026-B-0198");

  script_name(english:"Grafana Labs < 11.6.15 / 12.2.0 < 12.2.9 / 12.3.0 < 12.3.7 / 12.4.0 < 12.4.4 / 13.0.0 < 13.0.2 Multiple Vulnerabilities");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"The version of Grafana Labs installed on the remote host is affected by multiple vulnerabilities, including:

  - The public dashboard query endpoint does not limit request body size before processing, allowing
    unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads.
    This can lead to denial of service through memory exhaustion. (CVE-2026-42127)

  - An unauthenticated attacker can repeatedly call Grafana's OAuth login route with unique values, causing
    unbounded memory growth that can eventually exhaust memory and crash the Grafana instance (denial of
    service). (CVE-2026-8609)

  - Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body
    before processing it. An attacker can send very large payloads that force excessive memory allocation,
    potentially exhausting memory and causing a denial of service. (CVE-2026-33382)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://grafana.com/security/security-advisories/cve-2026-42127/");
  script_set_attribute(attribute:"see_also", value:"https://grafana.com/security/security-advisories/cve-2026-10601/");
  script_set_attribute(attribute:"see_also", value:"https://grafana.com/security/security-advisories/cve-2026-8609/");
  script_set_attribute(attribute:"see_also", value:"https://grafana.com/security/security-advisories/cve-2026-33382/");
  script_set_attribute(attribute:"solution", value:
"Update Grafana Labs to 11.6.15, 12.2.9, 12.3.7, 12.4.4, 13.0.2 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-42127");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/06/09");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/06/09");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/07/24");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:grafana:grafana");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Web Servers");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("grafana_labs_detect.nbin");
  script_require_keys("installed_sw/Grafana Labs");
  script_require_ports("Services/www", 3000);

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'Grafana Labs', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        {'fixed_version': '11.6.15'},
        {'min_version': '12.2.0', 'fixed_version': '12.2.9'},
        {'min_version': '12.3.0', 'fixed_version': '12.3.7'},
        {'min_version': '12.4.0', 'fixed_version': '12.4.4'},
        {'min_version': '13.0.0', 'fixed_version': '13.0.2'}
      ]
    }
  ]
};

var vdf_result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:vdf_result);