Grafana client path traversal and open redirect XSS

This repository provides a proof-of-concept exploit for CVE-2025-4123, a high-severity vulnerability in Grafana (versions 11.2 through 12.0) that enables both Server-Side Request Forgery (SSRF) and Cross-Site Scripting (XSS) attacks. The main file, CVE-2025-4123.py, is a Python Flask application that acts as a malicious server. It serves attacker-controlled JavaScript (for XSS) and JSON (for SSRF) payloads, with the attacker host configurable via command-line argument. The exploit leverages path traversal and open redirect vulnerabilities in Grafana to redirect users or the server to attacker-controlled content. The README.md provides detailed usage instructions, affected versions, and example routes for triggering the XSS and SSRF. The exploit is a POC and requires the attacker to run the Flask server and direct vulnerable Grafana instances to it using crafted URLs. No hardcoded external endpoints are present beyond the default localhost, but the attacker can specify any host. The repository is structured simply, with one Python exploit file and a README.

This repository provides a working exploit for CVE-2025-4123, a high-severity vulnerability in Grafana (versions 11.2 through 12.0) that enables Server-Side Request Forgery (SSRF) and Cross-Site Scripting (XSS). The repository contains a Python server (server.py) that serves attacker-controlled payloads, including a fake plugin manifest (data2.json) and a malicious JavaScript file (js.js). The exploit works by tricking the target Grafana instance into loading a plugin or resource from the attacker's server, which then delivers a JavaScript payload. This payload attempts to change the victim's account details by making an authenticated PUT request to the Grafana API endpoint /api/user, leveraging the victim's session. The server.py script prints out the exact routes to use for XSS and SSRF exploitation, and can be configured to use any attacker-controlled host. The repository is operational and provides all necessary components to demonstrate the exploit in a test environment.

This repository contains a proof-of-concept Python exploit for CVE-2025-4123, a path traversal vulnerability in Grafana's /public endpoint. The exploit (cve_2025_4123_exploit-mitsec.py) is an interactive CLI tool that allows the user to select between four attack modes: SSRF, LFI, open redirect, and XSS. The tool constructs malicious URLs by encoding traversal sequences and user-supplied input, then sends HTTP requests to the target Grafana instance. The README provides detailed usage instructions and example payloads for each attack type. The code is straightforward, using the requests library to interact with the target and print responses. The main entry point is the Python script, which guides the user through attack selection and payload customization. No hardcoded endpoints are present, but the payloads are constructed to target internal services (e.g., 169.254.169.254 for SSRF), local files (e.g., /etc/passwd for LFI), or inject JavaScript for XSS. The exploit is a functional PoC and does not include advanced payload customization or automation beyond interactive input.