Grafana Labs XSS (CVE-2025-6023)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(242625);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/01/21");

  script_cve_id("CVE-2025-6023");
  script_xref(name:"IAVB", value:"2025-B-0121-S");

  script_name(english:"Grafana Labs XSS (CVE-2025-6023)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"The version of Grafana Labs installed on the remote host is affected by a vulnerability as referenced in the 
CVE-2025-6023 advisory. 

  - An open redirect vulnerability has been identified in Grafana OSS that can be exploited to achieve XSS 
    attacks. The vulnerability was introduced in Grafana v11.5.0. The open redirect can be chained with path 
    traversal vulnerabilities to achieve XSS. (CVE-2025-6023)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://grafana.com/security/security-advisories/cve-2025-6023/");
  script_set_attribute(attribute:"solution", value:
"Update Grafana Labs to 11.3.8+security-01, 11.4.6+security-01, 11.5.6+security-01, 11.6.3+security-01, 12.0.2+security-01 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:P/A:P");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-6023");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/07/17");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/07/17");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/07/23");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:grafana:grafana");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Web Servers");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("grafana_labs_detect.nbin");
  script_require_ports("Services/www", 3000);

  exit(0);
}


include('vcf.inc');
include('http.inc');

var port = get_http_port(default:3000);

var app_info = vcf::get_app_info(app:'Grafana Labs', port:port, webapp:true);

var constraints = [
  { 'min_version' : '11.3.0', 'fixed_version': '11.3.8.01', 'fixed_display': '11.3.8+security-01' },
  { 'min_version' : '11.4.0', 'fixed_version': '11.4.6.01', 'fixed_display': '11.4.6+security-01' },
  { 'min_version' : '11.5.0', 'fixed_version': '11.5.6.01', 'fixed_display': '11.5.6+security-01' },
  { 'min_version' : '11.6.0', 'fixed_version': '11.6.3.01', 'fixed_display': '11.6.3+security-01' },
  { 'min_version' : '12.0.0', 'fixed_version': '12.0.2.01', 'fixed_display': '12.0.2+security-01' }
];

vcf::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_HOLE,
    flags:{'xss':true}
);