Very High
CVE-2020-13379
CVE-2020-13379
Description
The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. This vulnerability allows any unauthenticated user/client to make Grafana send HTTP requests to any URL and return its result to the user/client. This can be used to gain information about the network that Grafana is running on. Furthermore, passing invalid URL objects could be used for DOS’ing Grafana via SegFault.
Add Assessment
Technical Analysis
SSRF should be possible through https://vulnerable.host/avatar/redirect
That redirect is tricky since the vulnerable code is splitting on “/” and taking the last value. Need it to hit a url with a vulnerable redirect that can redirect to a metadata URL. From there it may be possible to hit the metadata url and grab STS tokens or pivot elsewhere.
Technical Analysis
This bug affects not only Grafana instances, but also Gitlab instances (under the
/-/grafanapath) and SourceTree instances (under the/-/debug/grafana/path).
This also affects GitLab, which presumably bundles Grafana. GitLab versions prior to 13.1.1 are affected. This increases the attack surface beyond just Grafana.
While I consider this a “primitive” in an exploit chain, it will certainly be useful to bug bounty hunters and the like. Seems people on Twitter may have gotten it to work already.
CVSS V3 Severity and Metrics
General Information
References
Advisory
Miscellaneous
could u plz give me a hint about how to use it for SSRF? I’m stuck here for a few days.
Check out the commit with the fix for pointers on how it can be exploited
https://github.com/grafana/grafana/pull/25322/files
I’ve checked this before, but this only shows that the vulnerability point is in ‘hash’. It’s really confused me how to use it for SSRF. just like a request splitting?
To see the result you can activate debug mode in Grafana, and open grafana.log after making a request. For the Author, how could DDOS be implemented via SegFault?
https://rhynorater.github.io/CVE-2020-13379-Write-Up