CVE-2020-13379 Server Side Request Forgery in Grafana
Unauthenticated attackers can exploit Grafana's avatar feature to perform Server-Side Request Forgery, accessing internal network resources and causing denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-13379?
CVE-2020-13379 is a high-severity server-side request forgery vulnerability in Fedoraproject Fedora, published on 3 Jun 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. This vulnerability allows any unauthenticated user/client to make Grafana send HTTP requests to any URL and return its result to the user/client. This can be used to gain information about the network that Grafana is running on. Furthermore, passing invalid URL objects could be used for DOS'ing Grafana via SegFault.
Weakness: CWE-918
Which versions are affected by CVE-2020-13379?
5 open source packages ship an affected version, including github.com/grafana/grafana and grafana. It affects 5 products.
| Package | Affected | Fixed in |
|---|---|---|
github.com/grafana/grafana Go | From 3.0.1 | 6.7.4 |
github.com/grafana/grafana Go | From 3.0.1 | 6.7.4 |
github.com/grafana/grafana Go | From 7.0.0 | 7.0.2 |
github.com/grafana/grafana Go | From 7.0.0 | 7.0.2 |
grafana Bitnami | From 3.0.1 | 7.0.2 |
Linux distribution packages (29)
grafana Red Hat:enterprise_linux:8::appstream | All versions | 0:6.3.6-2.el8_2 |
grafana-azure-monitor Red Hat:enterprise_linux:8::appstream | All versions | 0:6.3.6-2.el8_2 |
grafana-cloudwatch Red Hat:enterprise_linux:8::appstream | All versions | 0:6.3.6-2.el8_2 |
grafana-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:6.3.6-2.el8_2 |
grafana-elasticsearch Red Hat:enterprise_linux:8::appstream | All versions | 0:6.3.6-2.el8_2 |
grafana-graphite Red Hat:enterprise_linux:8::appstream | All versions | 0:6.3.6-2.el8_2 |
grafana-influxdb Red Hat:enterprise_linux:8::appstream | All versions | 0:6.3.6-2.el8_2 |
grafana-loki Red Hat:enterprise_linux:8::appstream | All versions | 0:6.3.6-2.el8_2 |
grafana-mssql Red Hat:enterprise_linux:8::appstream | All versions | 0:6.3.6-2.el8_2 |
grafana-mysql Red Hat:enterprise_linux:8::appstream | All versions | 0:6.3.6-2.el8_2 |
grafana-opentsdb Red Hat:enterprise_linux:8::appstream | All versions | 0:6.3.6-2.el8_2 |
grafana-postgres Red Hat:enterprise_linux:8::appstream | All versions | 0:6.3.6-2.el8_2 |
grafana-prometheus Red Hat:enterprise_linux:8::appstream | All versions | 0:6.3.6-2.el8_2 |
grafana-stackdriver Red Hat:enterprise_linux:8::appstream | All versions | 0:6.3.6-2.el8_2 |
grafana Red Hat:rhel_eus:8.1::appstream | All versions | 0:6.2.2-6.el8_1 |
grafana-azure-monitor Red Hat:rhel_eus:8.1::appstream | All versions | 0:6.2.2-6.el8_1 |
grafana-cloudwatch Red Hat:rhel_eus:8.1::appstream | All versions | 0:6.2.2-6.el8_1 |
grafana-debuginfo Red Hat:rhel_eus:8.1::appstream | All versions | 0:6.2.2-6.el8_1 |
grafana-elasticsearch Red Hat:rhel_eus:8.1::appstream | All versions | 0:6.2.2-6.el8_1 |
grafana-graphite Red Hat:rhel_eus:8.1::appstream | All versions | 0:6.2.2-6.el8_1 |
grafana-influxdb Red Hat:rhel_eus:8.1::appstream | All versions | 0:6.2.2-6.el8_1 |
grafana-loki Red Hat:rhel_eus:8.1::appstream | All versions | 0:6.2.2-6.el8_1 |
grafana-mssql Red Hat:rhel_eus:8.1::appstream | All versions | 0:6.2.2-6.el8_1 |
grafana-mysql Red Hat:rhel_eus:8.1::appstream | All versions | 0:6.2.2-6.el8_1 |
grafana-opentsdb Red Hat:rhel_eus:8.1::appstream | All versions | 0:6.2.2-6.el8_1 |
grafana-postgres Red Hat:rhel_eus:8.1::appstream | All versions | 0:6.2.2-6.el8_1 |
grafana-prometheus Red Hat:rhel_eus:8.1::appstream | All versions | 0:6.2.2-6.el8_1 |
grafana-stackdriver Red Hat:rhel_eus:8.1::appstream | All versions | 0:6.2.2-6.el8_1 |
grafana Red Hat:storage:3.5:wa:el7 | All versions | 0:5.2.4-3.el7rhgs |
Products include Fedoraproject Fedora, Grafana Grafana, Netapp E-Series Performance Analyzer, Opensuse Backports Sle, Opensuse Leap.
How do I fix CVE-2020-13379?
Upgrade github.com/grafana/grafana to a fixed version for your release line: 6.7.4 or 7.0.2.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2020-13379 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-13379 exists.
Public exploit code: 1 Exploit-DB entry and 1 Nuclei template.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as BIT-grafana-2020-13379, GHSA-wc9w-wvq2-ffm9, RHSA-2020:2641, RHSA-2020:2676, RHSA-2020:5599.