Grafana Labs < 11.6.1+security-01 Authorization Bypass (CVE-2025-3260)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(237905);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/01/21");

  script_cve_id("CVE-2025-3260");
  script_xref(name:"IAVB", value:"2025-B-0087-S");

  script_name(english:"Grafana Labs < 11.6.1+security-01 Authorization Bypass (CVE-2025-3260)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"The version of Grafana Labs installed on the remote host is affected by a vulnerability as referenced in the 
CVE-2025-3260 advisory. Grafana's datasource proxy API allows authorization checks to be bypassed by adding an 
extra slash character in the URL path. Users with minimal permissions could gain unauthorized read access to GET 
endpoints in Alertmanager and Prometheus datasources. The issue primarily affects datasources that implement 
route-specific permissions, including Alertmanager and certain Prometheus-based datasources.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://grafana.com/security/security-advisories/cve-2025-3260/");
  script_set_attribute(attribute:"solution", value:
"Update Grafana Labs to 11.6.1+security-01 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:P/I:N/A:N");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-3260");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/06/02");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/06/02");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/06/06");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:grafana:grafana");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Web Servers");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("grafana_labs_detect.nbin");
  script_require_ports("Services/www", 3000);

  exit(0);
}

include('vcf.inc');
include('http.inc');


var port = get_http_port(default:3000);

var app_info = vcf::get_app_info(app:'Grafana Labs', port:port, webapp:TRUE);

if (app_info['Security Patch'])
{
  var match = pregmatch(string:app_info['Security Patch'], pattern:"security-([0-9]+)");
  if (!empty_or_null(match))
    var sp_num = uint(match[1]);

  if (sp_num >= 1)
  {
    if (app_info['version'] == '11.6.1')
      audit(AUDIT_WEB_APP_NOT_AFFECTED, 'Grafana Labs', port);
  }
}

var constraints = [
  { 'min_version' : '11.6.0', 'max_version': '11.6.1', 'fixed_display': '11.6.1+security-01' }
];

vcf::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_WARNING
);