Snapchat · Report #663628
Access to multiple production Grafana dashboards
Validstatus
highseverity
$10,000bounty
464upvotes
4 Nov 2020disclosed
Summary
@damian89 found a production Grafana instance which displayed confidential metrics inside various dashboards.
While fuzzing patterns of certain snapchat related projects, I was able to find an instance of Grafana which was accessible by a guest user. That instance contained hundreds of production dashboards, valuable data about company. Furthermore one of the custom modules was vulnerable to SQL Injection.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.