CVE-2022-26148

published 2022-03-21

CVE-2022-26148: An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix. The Zabbix password can be found in the api_jsonrpc.php HTML source code. When…

Priority P1 78 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

EXPLOIT

An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix. The Zabbix password can be found in the api_jsonrpc.php HTML source code. When the user logs in and allows the user to register, one can right click to view the source code and use Ctrl-F to search for password in api_jsonrpc.php to discover the Zabbix account password and URL address.

Affected

5 ranges

Vendor	Product	Version range	Fixed in
grafana	grafana	<= 7.3.4	—
redhat	ceph_storage	—	—
redhat	ceph_storage	—	—
redhat	ceph_storage	—	—
redhat	storage	—	—

Detection & IOCs extracted from sources · hover to see the quote

url /login?redirect=%2F↗

path /api_jsonrpc.php↗

yara

body contains '"zabbix":' OR '"zbx":' OR 'alexanderzobnin-zabbix-datasource' AND regex match '"password":"(.*?)"' AND '"username":"(.*?)"'

sigma

regex: '"url":"([a-z:/0-9.]+)\/api_jsonrpc\.php'

• → Send a GET request to /login?redirect=%2F and inspect the response body for the strings '"zabbix":', '"zbx":', or 'alexanderzobnin-zabbix-datasource' combined with regex matches for '"password":"(.*?)"' and '"username":"(.*?)"' — presence of all indicates credential exposure.
• → Use Shodan queries 'title:"Grafana"', 'cpe:"cpe:2.3:a:grafana:grafana"', or 'http.title:"grafana"' to identify exposed Grafana instances for targeted scanning.
• → Use FOFA queries 'app="Grafana"', 'title="grafana"' or Google dork 'intitle:"grafana"' to enumerate internet-facing Grafana instances potentially vulnerable to credential disclosure.
• → Extract the Zabbix API URL from the login page HTML using the regex '"url":"([a-z:/0-9.]+)\/api_jsonrpc\.php' — a successful match reveals the backend Zabbix endpoint alongside plaintext credentials.

• · Vulnerability only manifests when Grafana is integrated with the Zabbix datasource plugin (alexanderzobnin-zabbix-datasource); standalone Grafana instances are not affected. ↗
• · Credentials are exposed in the HTML source of the login page only when user registration is enabled; the attacker does not need to be authenticated. ↗

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P

osv 9.8 CRITICAL

vendor_redhat 9.8 CRITICAL

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-312