id: CVE-2021-39226 info: name: Grafana Snapshot Authentication Bypass author: Evan Rubinstein description: Grafana instances up to 7.5.11 and 8.1.5 allow remote unauthenticated users to view the snapshot associated with the lowest database key by accessing the literal paths /api/snapshot/:key or /dashboard/snapshot/:key. If the snapshot is in public mode, unauthenticated users can delete snapshots by accessing the endpoint /api/snapshots-delete/:deleteKey. Authenticated users can also delete snapshots by accessing the endpoints /api/snapshots-delete/:deleteKey, or sending a delete request to /api/snapshot/:key, regardless of whether or not the snapshot is set to public mode (disabled by default). remediation: "This issue has been resolved in versions 8.1.6 and 7.5.11. If you cannot upgrade you can block access to the literal paths: /api/snapshots/:key, /api/snapshots-delete/:deleteKey, /dashboard/snapshot/:key, and /api/snapshots/:key. They have no normal function and can be disabled without side effects." reference: - https://github.com/advisories/GHSA-69j6-29vr-p3j9 - https://nvd.nist.gov/vuln/detail/CVE-2021-39226 severity: critical tags: cve,cve2021,grafana classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.80 cve-id: CVE-2021-39226 cwe-id: CWE-200 requests: - method: GET path: - "{{BaseURL}}/api/snapshots/:key" matchers-condition: and matchers: - type: status status: - 200 - type: word words: - '"isSnapshot":true' # Enhanced by cs on 2022/02/22