Over a Third of Grafana Instances Exposed to XSS Flaw
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-4123 | Unauthenticated XSS in Grafana via client path traversal and open redirect CVE-2025-4123 is a cross-site scripting flaw (CWE-79) in Grafana that results from combining a client-side path traversal with an open redirect (CWE-601). An attacker crafts a link that redirects a Grafana user to a site hosting a malicious frontend plugin that executes arbitrary JavaScript in the context of the victim's Grafana session; the attack requires no editor or special privileges and works against anonymous users when anonymous access is enabled. If the Grafana Image Renderer plugin is installed, the same open redirect can be escalated to a full-read SSRF, letting the attacker read content from internal services reachable from the Grafana server. Grafana's default Content-Security-Policy blocks the XSS via its connect-src directive, so risk concentrates on internet-facing instances running anonymous access, relaxed/custom CSP, or the Image Renderer plugin; public reporting indicates over a third of Grafana instances are exposed to the flaw. No public proof-of-concept or confirmed in-the-wild exploitation is known yet, but EPSS assigns a 97% probability of exploitation within 30 days. Do: Upgrade internet-facing Grafana instances to the patched release for your release line per Grafana's security advisory for CVE-2025-4123 (the source data does not include fixed version numbers, so consult the advisory), prioritizing instances with anonymous access enabled. Keep Grafana's default Content-Security-Policy in place, since its connect-src directive blocks the XSS, and remove or network-restrict the Grafana Image Renderer plugin where a full-read SSRF could reach sensitive internal services. Given the 97% EPSS score, treat this as likely to be exploited soon and audit whether your CSP has been customized or relaxed and whether Grafana is reachable without authentication. | 6.1 | 97% |
| mass≈100,000+ internet-exposed Grafana instances |
Full article391 words · extracted from infosecurity-magazine.com · click to collapse
Security researchers have urged DevOps teams to patch a high-severity flaw in popular tool Grafana that could be putting them at risk of account takeover attacks.
Ox Security warned on Sunday that CVE-2025-4123 impacts 36% of public-facing Grafana instances – or over 46,000 worldwide – as well as countless Grafana servers not connected to the internet.
Open source analytics and visualization platform Grafana is used by DevOps engineers, sysadmins and developers to help them monitor system performance and infrastructure.
The vulnerability in question, dubbed “the Grafana Ghost,” was discovered and patched back in May.
According to a description in the National Vulnerability Database (NVD), it’s a cross-site scripting (XSS) bug caused by combining a client path traversal and open redirect.
“This allows attackers to redirect users to a website that hosts a frontend plugin that will execute arbitrary JavaScript. This vulnerability does not require editor permissions and if anonymous access is enabled, the XSS will work,” it added.
“If the Grafana Image Renderer plugin is installed, it is possible to exploit the open redirect to achieve a full read SSRF.”
Ox Security explained that the vulnerability is compromised of a chain of exploits that starts with a malicious link sent to the victim.
“When clicked, the link makes Grafana use an external malicious plugin hosted on the attacker’s server,” the security vendor continued.
“This malicious plugin is capable of running any code on behalf of the user. In our particular case, the code running leads to changing the victim’s Grafana username and login email to values controlled by the attacker or can redirect to internal services. Once the email is changed, the attacker can use it to reset the victim’s password and gain access to their Grafana account.”
Read more on DevOps risks: Cryptojacking Campaign Targets DevOps Servers Including Nomad
By compromising a Grafana account, hackers could gain access to a victim organization’s sensitive operational data and business intelligence, the vendor warned. By locking out legitimate users, they could also cause major operational issues, if IT teams lose visibility into critical systems, it added.
“While talking about a high percentage of publicly available Grafana servers, the vulnerability also affects Grafana instances running locally by crafting a payload that takes advantage of the locally used domain name and port for the local service,” Ox Security said.
Image credit: T. Schneider / Shutterstock.com
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/over-third-grafana-instances/