Grafana Labs < 10.4.17+security-01, 11.2.8+security-01, 11.3.5+security-01, 11.4.3+security-01, 11.5.3+security-01, 11.6.0+security-01 Improper Authorization (CVE-2025-3454)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(242132);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/08/25");

  script_cve_id("CVE-2025-3454");
  script_xref(name:"IAVB", value:"2025-B-0096-S");

  script_name(english:"Grafana Labs < 10.4.17+security-01, 11.2.8+security-01, 11.3.5+security-01, 11.4.3+security-01, 11.5.3+security-01, 11.6.0+security-01 Improper Authorization (CVE-2025-3454)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"The version of Grafana Labs installed on the remote host is affected by improper authorization vulnerability as 
referenced in the CVE-2025-3454 advisory. 

  - This vulnerability in Grafana's datasource proxy API allows authorization checks to be bypassed by adding 
    an extra slash character in the URL path. Users with minimal permissions could gain unauthorized read 
    access to GET endpoints in Alertmanager and Prometheus datasources. The issue primarily affects 
    datasources that implement route-specific permissions, including Alertmanager and certain 
    Prometheus-based datasources. (CVE-2025-3454)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://grafana.com/security/security-advisories/cve-2025-3454/");
  script_set_attribute(attribute:"solution", value:
"Update Grafana Labs to 10.4.17+security-01, 11.2.8+security-01, 11.3.5+security-01, 11.4.3+security-01, 11.5.3+security-01, 11.6.0+security-01 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:P/I:N/A:N");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-3454");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/06/02");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/06/02");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/07/15");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:grafana:grafana");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Web Servers");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("grafana_labs_detect.nbin");
  script_require_ports("Services/www", 3000);

  exit(0);
}


include('vcf.inc');
include('http.inc');

var port = get_http_port(default:3000);

var app_info = vcf::get_app_info(app:'Grafana Labs', port:port, webapp:TRUE);

var constraints = [
  { 'min_version' : '0.0.0', 'fixed_version': '10.4.17.01', 'fixed_display': '10.4.17+security-01' },
  { 'min_version' : '11.1.0', 'fixed_version': '11.2.8.01', 'fixed_display': '11.2.8+security-01' },
  { 'min_version' : '11.3.0', 'fixed_version': '11.3.5.01', 'fixed_display': '11.3.5+security-01' },
  { 'min_version' : '11.4.0', 'fixed_version': '11.4.3.01', 'fixed_display': '11.4.3+security-01' },
  { 'min_version' : '11.5.0', 'fixed_version': '11.5.3.01', 'fixed_display': '11.5.3+security-01' },
  { 'min_version' : '11.6.0', 'fixed_version': '11.6.0.01', 'fixed_display': '11.6.0+security-01' }
];

vcf::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_WARNING
);