Lucene search

K
nessusThis script is Copyright (C) 2023-2024 and is owned by Tenable, Inc. or an Affiliate thereof.GRAFANA_CVE-2022-31097.NASL
HistoryNov 03, 2023 - 12:00 a.m.

Grafana Labs Stored XSS (CVE-2022-31097)

2023-11-0300:00:00
This script is Copyright (C) 2023-2024 and is owned by Tenable, Inc. or an Affiliate thereof.
www.tenable.com
76
grafana labs
stored xss
cross-site scripting
elevate privileges
cve-2022-31097
upgrade
version 8.3.10
version 8.4.10
version 8.5.9
version 9.0.3
version 9.2.7
version 9.3.0

CVSS3

8.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

AI Score

8.1

Confidence

High

EPSS

0.006

Percentile

77.6%

According to its self-reported version number, the version of Grafana Labs running on the remote host is affected by a stored cross-site scripting vulnerability:

  • XSS vulnerability in the Unified Alerting feature of Grafana. After analysis, this stored XSS could be used to elevate privileges from Editor to Admin. (CVE-2022-31097) Note that Nessus has not tested for these issues but has instead relied only on the application’s self-reported version number.
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(184357);
  script_version("1.4");
  script_set_attribute(attribute:"plugin_modification_date", value:"2024/02/16");

  script_cve_id("CVE-2022-31097");
  script_xref(name:"IAVB", value:"2023-B-0087-S");

  script_name(english:"Grafana Labs Stored XSS (CVE-2022-31097)");

  script_set_attribute(attribute:"synopsis", value:
"The web application running on the remote web server is affected by a cross-site scripting vulnerability.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version number, the version of Grafana Labs running on the
remote host is affected by a stored cross-site scripting vulnerability:

 - XSS vulnerability in the Unified Alerting feature of Grafana. After analysis, this stored XSS could be used to 
   elevate privileges from Editor to Admin. (CVE-2022-31097)
 
 Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
 number.");
  # https://grafana.com/blog/2022/11/29/grafana-security-release-new-versions-with-high-severity-security-fix-for-cve-2022-31097/
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?3b104bbb");
  # https://github.com/grafana/grafana/security/advisories/GHSA-vw7q-p2qg-4m5f
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?d56588b2");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Grafana 8.3.10, 8.4.10, 8.5.9, 9.0.3, 9.2.7, 9.3.0 or later");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2022-31097");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2022/07/14");
  script_set_attribute(attribute:"patch_publication_date", value:"2022/07/14");
  script_set_attribute(attribute:"plugin_publication_date", value:"2023/11/03");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:grafana:grafana");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Web Servers");

  script_copyright(english:"This script is Copyright (C) 2023-2024 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("grafana_labs_detect.nbin");
  script_require_keys("installed_sw/Grafana Labs");
  script_require_ports("Services/www", 3000);

  exit(0);
}
include('vcf.inc');
include("http.inc");

var port = get_http_port(default:3000);

var app_info = vcf::get_app_info(app:'Grafana Labs', port:port, webapp:TRUE);

var constraints = [
  { 'min_version' : '8.0', 'fixed_version' : '8.3.10' }, 
  { 'min_version' : '8.4', 'fixed_version' : '8.4.10' },
  { 'min_version' : '8.5', 'fixed_version' : '8.5.9' },
  { 'min_version' : '9.0', 'fixed_version' : '9.0.3' },
  { 'min_version' : '9.1.0-beta1', 'fixed_version' : '9.2.7' }, 
  {'min_version' : '9.3.0-beta1', 'fixed_version' : '9.3.0'}
];

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_HOLE, flags:{'xss': TRUE});

CVSS3

8.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

AI Score

8.1

Confidence

High

EPSS

0.006

Percentile

77.6%