ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

CVE-2021-39226

KEV PoC mass

Authentication Bypass in Grafana Exposes and Deletes Dashboard Snapshot Data

CISA: Grafana Authentication Bypass Vulnerability

CVSS 3.1
7.3 high
EPSS
100%p100
Published
()
KEV added
AI analysis

Grafana contains an authentication bypass (CWE-287) in its handling of dashboard snapshot data, allowing both authenticated and unauthenticated users to access snapshot endpoints without proper authorization. An attacker can trigger the flaw by sending crafted requests to the snapshot API without valid credentials. Successful exploitation lets the attacker view and delete all snapshot data, potentially resulting in complete loss of saved snapshots, which may destroy evidence of historical dashboard state. Any organization running an affected Grafana release from Grafana Labs is exposed, particularly instances reachable by untrusted users. Exploitation is confirmed in the wild: the flaw was added to CISA KEV on 2022-08-25 and carries a 99.9% EPSS probability of exploitation within 30 days.

What to do: Apply updates per vendor instructions: upgrade Grafana to a patched release per the Grafana Labs advisory for CVE-2021-39226 and prioritize patching internet-facing instances given KEV listing. As an interim mitigation, restrict unauthenticated access to the snapshot API (e.g., via reverse-proxy access rules) and verify whether snapshots have been viewed or deleted on your instances.

Affected
Grafana Labs Grafana—
Estimated exposure
masslikely >100,000 internet-exposed Grafana instances, with many more deployed internally — Public internet-wide scans (Shodan/Censys-type indexing) have repeatedly indexed on the order of hundreds of thousands of Grafana instances, and Grafana is one of the most widely deployed open-source observability dashboards, so exposure…

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description

Grafana is an open source data visualization platform. In affected versions unauthenticated and authenticated users are able to view the snapshot with the lowest database key by accessing the literal paths: /dashboard/snapshot/:key, or /api/snapshots/:key. If the snapshot "public_mode" configuration setting is set to true (vs default of false), unauthenticated users are able to delete the snapshot with the lowest database key by accessing the literal path: /api/snapshots-delete/:deleteKey. Regardless of the snapshot "public_mode" setting, authenticated users are able to delete the snapshot with the lowest database key by accessing the literal paths: /api/snapshots/:key, or /api/snapshots-delete/:deleteKey. The combination of deletion and viewing enables a complete walk through all snapshot data while resulting in complete snapshot data loss. This issue has been resolved in versions 8.1.6 and 7.5.11. If for some reason you cannot upgrade you can use a reverse proxy or similar to block access to the literal paths: /api/snapshots/:key, /api/snapshots-delete/:deleteKey, /dashboard/snapshot/:key, and /api/snapshots/:key. They have no normal function and can be disabled without side effects.

CISA Known Exploited Vulnerability
Affected
Grafana Labs Grafana
Required action
Apply updates per vendor instructions.
Due date
Ransomware use
Unknown
Vendors
grafanafedoraproject
Products
grafana, fedora
Weakness
CWE-287, CWE-862
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
NVD CVE.org CISA KEV GitHub PoCs EPSS (99.9%)

In the news