CVE-2021-41174
published 2021-11-03CVE-2021-41174: Grafana is an open-source platform for monitoring and observability. In affected versions if an attacker is able to convince a victim to visit a URL…
PriorityP277medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
84.61%
99.7th percentile
Grafana is an open-source platform for monitoring and observability. In affected versions if an attacker is able to convince a victim to visit a URL referencing a vulnerable page, arbitrary JavaScript content may be executed within the context of the victim's browser. The user visiting the malicious link must be unauthenticated and the link must be for a page that contains the login button in the menu bar. The url has to be crafted to exploit AngularJS rendering and contain the interpolation binding for AngularJS expressions. AngularJS uses double curly braces for interpolation binding: {{ }} ex: {{constructor.constructor(‘alert(1)’)()}}. When the user follows the link and the page renders, the login button will contain the original link with a query parameter to force a redirect to the login page. The URL is not validated and the AngularJS rendering engine will execute the JavaScript expression contained in the URL. Users are advised to upgrade as soon as possible. If for some reason you cannot upgrade, you can use a reverse proxy or similar to block access to block the literal string {{ in the path.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| grafana | data | >= 8.0.0 < 8.2.3 | 8.2.3 |
| grafana | grafana | — | — |
| grafana | grafana | >= 8.0.0 < 8.2.3 | 8.2.3 |
Detection & IOCsextracted from sources · hover to see the quote
url/dashboard/snapshot/%7B%7Bconstructor.constructor(%27alert(document.domain)%27)()%7D%7D?orgId=1
yara
regex: '"subTitle":"Grafana (v8\.(?:(?:1|0)\.[0-9]|2\.[0-2]))'
- →Look for URL-encoded double curly braces (%7B%7B / %7D%7D) in HTTP request paths targeting Grafana /dashboard/snapshot/ endpoints, indicating AngularJS interpolation injection attempts.
- →Block or alert on requests containing the literal string '{{' in the URL path to Grafana, as recommended by the advisory for reverse proxy mitigations. ↗
- →Fingerprint vulnerable Grafana instances by matching HTTP response body for both 'Grafana' and 'frontend_boot_js_done_time_seconds', combined with a subTitle version string matching v8.0.x, v8.1.x, or v8.2.0–8.2.2.
- →Use Shodan/FOFA queries to identify exposed Grafana instances: Shodan title:"Grafana", FOFA title="grafana", Google intitle:"grafana".
- →The attack targets unauthenticated pages that render the login button; monitor for XSS payloads delivered via the redirect/login flow on Grafana snapshot or dashboard pages. ↗
- ·Vulnerable version range is Grafana 8.0.0 through 8.2.2 only; versions outside this range (including older versions shipped with RHEL 8/9 and OpenShift 4) are not affected.
- ·The exploit requires the victim to be unauthenticated; authenticated sessions are not directly targeted by this vector. ↗
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
ghsa6.1MEDIUM
osv6.1MEDIUM
vulncheck6.9MEDIUM
vendor_redhat6.9MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
grafana: XSS vulnerability on unauthenticated pages through interpolation binding expressions for AngularJS in URL
vendor_redhat·2021-11-03·CVSS 6.9
CVE-2021-41174 [MEDIUM] CWE-79 grafana: XSS vulnerability on unauthenticated pages through interpolation binding expressions for AngularJS in URL
grafana: XSS vulnerability on unauthenticated pages through interpolation binding expressions for AngularJS in URL
Grafana is an open-source platform for monitoring and observability. In affected versions if an attacker is able to convince a victim to visit a URL referencing a vulnerable page, arbitrary JavaScript content may be executed within the context of the victim's browser. The user visiting the malicious link must be unauthenticated and the link must be for a page that contains the login button in the menu bar. The url has to be crafted to exploit AngularJS rendering and contain the interpolation binding for AngularJS expressions. AngularJS uses double curly braces for interpolation binding: {{ }} ex: {{constructor.constructor(‘alert(1)’)()}}. When the user follows the link and th
OSV
XSS vulnerability allowing arbitrary JavaScript execution
osv·2021-11-08·CVSS 6.1
CVE-2021-41174 [MEDIUM] XSS vulnerability allowing arbitrary JavaScript execution
XSS vulnerability allowing arbitrary JavaScript execution
Today we are releasing Grafana 8.2.3. This patch release includes an important security fix for an issue that affects all Grafana versions from 8.0.0-beta1.
[Grafana Cloud](https://grafana.com/cloud) instances have already been patched and an audit did not find any usage of this attack vector. [Grafana Enterprise](https://grafana.com/products/enterprise) customers were provided with updated binaries under embargo.
## CVE-2021-41174 XSS vulnerability on unauthenticated pages
### Summary
CVSS Score: 6.9 Medium
CVSS:[CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:N/E:U/RL:O/RC:R/CR:L/MAV:N/MAC:H/MPR:N/MUI:R/MS:C/MC:N/MI:H/MA:L](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:N/E:U/RL:O/RC:R/CR:L/MA
GHSA
XSS vulnerability allowing arbitrary JavaScript execution
ghsa·2021-11-08·CVSS 6.1
CVE-2021-41174 [MEDIUM] CWE-79 XSS vulnerability allowing arbitrary JavaScript execution
XSS vulnerability allowing arbitrary JavaScript execution
Today we are releasing Grafana 8.2.3. This patch release includes an important security fix for an issue that affects all Grafana versions from 8.0.0-beta1.
[Grafana Cloud](https://grafana.com/cloud) instances have already been patched and an audit did not find any usage of this attack vector. [Grafana Enterprise](https://grafana.com/products/enterprise) customers were provided with updated binaries under embargo.
## CVE-2021-41174 XSS vulnerability on unauthenticated pages
### Summary
CVSS Score: 6.9 Medium
CVSS:[CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:N/E:U/RL:O/RC:R/CR:L/MAV:N/MAC:H/MPR:N/MUI:R/MS:C/MC:N/MI:H/MA:L](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:N/E:U/RL:O/RC:R/CR:L/MA
OSV
CVE-2021-41174: Grafana is an open-source platform for monitoring and observability
osv·2021-11-03·CVSS 6.1
CVE-2021-41174 [MEDIUM] CVE-2021-41174: Grafana is an open-source platform for monitoring and observability
Grafana is an open-source platform for monitoring and observability. In affected versions if an attacker is able to convince a victim to visit a URL referencing a vulnerable page, arbitrary JavaScript content may be executed within the context of the victim's browser. The user visiting the malicious link must be unauthenticated and the link must be for a page that contains the login button in the menu bar. The url has to be crafted to exploit AngularJS rendering and contain the interpolation binding for AngularJS expressions. AngularJS uses double curly braces for interpolation binding: {{ }} ex: {{constructor.constructor(‘alert(1)’)()}}. When the user follows the link and the page renders, the login button will contain the original link with a query parameter to force a redirect to the lo
VulnCheck
Grafana Labs Grafana Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
vulncheck·2021·CVSS 6.9
CVE-2021-41174 [MEDIUM] Grafana Labs Grafana Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Grafana Labs Grafana Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Grafana is an open-source platform for monitoring and observability. In affected versions if an attacker is able to convince a victim to visit a URL referencing a vulnerable page, arbitrary JavaScript content may be executed within the context of the victim's browser. The user visiting the malicious link must be unauthenticated and the link must be for a page that contains the login button in the menu bar. The url has to be crafted to exploit AngularJS rendering and contain the interpolation binding for AngularJS expressions. AngularJS uses double curly braces for interpolation binding: {{ }} ex: {{constructor.constructor(‘alert(1)’)()}}. When the user follows the link and the page re
No detection rules found.
Nuclei
Grafana 8.0.0 <= v.8.2.2 - Angularjs Rendering Cross-Site Scripting
nuclei·CVSS 6.1
CVE-2021-41174 [MEDIUM] Grafana 8.0.0 <= v.8.2.2 - Angularjs Rendering Cross-Site Scripting
Grafana 8.0.0 <= v.8.2.2 - Angularjs Rendering Cross-Site Scripting
Grafana is an open-source platform for monitoring and observability. In affected versions if an attacker is able to convince a victim to visit a URL referencing a vulnerable page, arbitrary JavaScript content may be executed within the context of the victim's browser. The user visiting the malicious link must be unauthenticated and the link must be for a page that contains the login button in the menu bar. The url has to be crafted to exploit AngularJS rendering and contain the interpolation binding for AngularJS expressions.
Template:
id: CVE-2021-41174
info:
name: Grafana 8.0.0 <= v.8.2.2 - Angularjs Rendering Cross-Site Scripting
author: pdteam
severity: medium
description: Grafana is an open-source platform for mon
Unit42
Network Security Trends: November 2021 to January 2022
blogs_unit42·2022-05-31
Network Security Trends: November 2021 to January 2022
Threat Research Center
Threat Research
Vulnerabilities
## Network Security Trends: November 2021 to January 2022
Yue Guan
Published: May 31, 2022
Threat Research
Vulnerabilities
Apache Log4j
Attack analysis
Denial of service
Exploit in Wild
Network security trends
## Executive Summary
Unit 42 researchers continually observe network attacks and search for insights that can assist defenders. Here, we summarize key trends from November 2021 to January 2022. In the following sections, we present our analysis of the most recently published vulnerabilities, including the severity distribution. We also classify vulnerabilities to provide a clear view of the prevalence of, for example, cross-site scripting or denial of service.
Cross-site scripting stood out as a commonly used t
Unit42
Network Security Trends: November 2021 to January 2022
blogs_unit42·2022-05-31·CVSS 9.8
[CRITICAL] Network Security Trends: November 2021 to January 2022
## Executive Summary
Unit 42 researchers continually observe network attacks and search for insights that can assist defenders. Here, we summarize key trends from November 2021 to January 2022. In the following sections, we present our analysis of the most recently published vulnerabilities, including the severity distribution. We also classify vulnerabilities to provide a clear view of the prevalence of, for example, cross-site scripting or denial of service.
Cross-site scripting stood out as a commonly used technique. Among around 6,443 newly published vulnerabilities, we found that a large portion (almost 10.6%) still involve this technique. However, by evaluating around 167 million attack sessions and focusing on the latest exploits in the wild, we conclude that remote code execution
https://github.com/grafana/grafana/commit/31b78d51c693d828720a5b285107a50e6024c912https://github.com/grafana/grafana/commit/3cb5214fa45eb5a571fd70d6c6edf0d729983f82https://github.com/grafana/grafana/commit/fb85ed691290d211a5baa44d9a641ab137f0de88https://github.com/grafana/grafana/security/advisories/GHSA-3j9m-hcv9-rpj8https://security.netapp.com/advisory/ntap-20211125-0003/https://github.com/grafana/grafana/commit/31b78d51c693d828720a5b285107a50e6024c912https://github.com/grafana/grafana/commit/3cb5214fa45eb5a571fd70d6c6edf0d729983f82https://github.com/grafana/grafana/commit/fb85ed691290d211a5baa44d9a641ab137f0de88https://github.com/grafana/grafana/security/advisories/GHSA-3j9m-hcv9-rpj8https://security.netapp.com/advisory/ntap-20211125-0003/
2021-11-03
Published
Exploited in the wild