Grafana Labs Privilege Escalation (CVE-2024-9476)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(211633);
  script_version("1.4");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/02/06");

  script_cve_id("CVE-2024-9476");
  script_xref(name:"IAVB", value:"2024-B-0174-S");

  script_name(english:"Grafana Labs Privilege Escalation (CVE-2024-9476)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"The version of Grafana Labs installed on the remote host is affected by a vulnerability as referenced in the 
CVE-2024-9476 advisory.

  - A vulnerability in Grafana Labs Grafana OSS and Enterprise allows Privilege Escalation allows users to gain access
    to resources from other organizations within the same Grafana instance via the Grafana Cloud Migration Assistant.
    This vulnerability will only affect users who utilize the Organizations feature to isolate resources on their 
    Grafana instance.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://grafana.com/security/security-advisories/cve-2024-9476/");
  script_set_attribute(attribute:"solution", value:
"See vendor advisory");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:M/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-9476");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/11/12");
  script_set_attribute(attribute:"patch_publication_date", value:"2024/11/12");
  script_set_attribute(attribute:"plugin_publication_date", value:"2024/11/20");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:grafana:grafana");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Web Servers");

  script_copyright(english:"This script is Copyright (C) 2024-2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("grafana_labs_detect.nbin");
  script_require_keys("Settings/ParanoidReport");
  script_require_ports("Services/www", 3000);

  exit(0);
}

include('vcf.inc');
include('http.inc');

if (report_paranoia < 2) audit(AUDIT_PARANOID);

var port = get_http_port(default:3000);

var app_info = vcf::get_app_info(app:'Grafana Labs', port:port, webapp:TRUE);

if (app_info['Security Patch'])
{
  var match = pregmatch(string:app_info['Security Patch'], pattern:"security-([0-9]+)");
  if (!empty_or_null(match))
    var sp_num = uint(match[1]);

  if (sp_num >= 1)
  {
    if (app_info['version'] == '11.2.3')
      audit(AUDIT_WEB_APP_NOT_AFFECTED, 'Grafana Labs', port);
    else if (app_info['version'] == '11.3.0')
      audit(AUDIT_WEB_APP_NOT_AFFECTED, 'Grafana Labs', port);
  }
}

var constraints = [
  { 'min_version' : '11.2.0', 'max_version' : '11.2.3', 'fixed_display' : '11.2.3+security-01' },
  { 'equal' : '11.3.0', 'fixed_display' : '11.3.0+security-01' },
];

vcf::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_WARNING
);