HexBrain

Snapchat · Report #663628

Access to multiple production Grafana dashboards

Validstatus
highseverity
$10,000bounty
464upvotes
4 Nov 2020disclosed

Summary

@damian89 found a production Grafana instance which displayed confidential metrics inside various dashboards.

While fuzzing patterns of certain snapchat related projects, I was able to find an instance of Grafana which was accessible by a guest user. That instance contained hundreds of production dashboards, valuable data about company. Furthermore one of the custom modules was vulnerable to SQL Injection.

How it was found

The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original