Grafana Enterprise SCIM externalId privilege escalation and user impersonation

Repository contains a single Python PoC exploit (CVE-2025-41115.py) and a README describing a critical Grafana Enterprise SCIM privilege-escalation/account-takeover issue. Core exploit behavior: - Takes a base URL argument (e.g., http(s)://host:3000). - Sends an HTTP POST to the Grafana SCIM endpoint /api/scim/v2/Users with SCIM JSON (schemas urn:ietf:params:scim:schemas:core:2.0:User). - Sets externalId to a numeric string (TARGET_UID="1" by default), relying on the described vulnerability where Grafana incorrectly maps numeric externalId to an internal user ID, enabling overwrite/impersonation of that user (commonly admin UID 1). - Uses Authorization: Bearer <token> and Content-Type: application/scim+json. - Iterates through a list of hardcoded ‘default/leaked’ token strings plus a user-editable TOKEN value, attempting exploitation until a 200/201 response is received. - On success, prints the attacker username/email (rooted<timestamp>@pwn.lab) and dumps the JSON response. Targeting/requirements (per README and code): - Grafana Enterprise (OSS not affected). - SCIM provisioning enabled and user syncing enabled. - A valid SCIM token is required; the script disables TLS verification (verify=False) and suppresses urllib3 warnings. Repository structure/purpose: - CVE-2025-41115.py: one-file, runnable PoC intended for quick testing against a provided Grafana base URL. - README.md: vulnerability overview, affected versions (claims 12.0.0–12.2.1 vulnerable; 12.3.0 patched), usage examples, and mitigation guidance.

This repository contains a proof-of-concept (PoC) exploit for CVE-2025-41115, a critical privilege escalation vulnerability in Grafana Enterprise's SCIM user provisioning feature. The exploit is implemented in a single Python script (CVE-2025-41115.py) and is accompanied by a detailed README.md explaining the vulnerability, affected versions, exploitation steps, and mitigation advice. The exploit targets Grafana Enterprise instances (versions 12.0.0 to 12.2.1) with SCIM provisioning enabled and user syncing active. By sending a crafted SCIM API request with a numeric 'externalId' (set to '1', the admin UID), the script can overwrite the admin account with an attacker-controlled user, granting full admin access. The script attempts exploitation using a set of default/leaked SCIM tokens, but a valid token may be required if the defaults fail. The main attack vector is network-based, exploiting the SCIM API endpoint '/api/scim/v2/Users' over HTTP(S). The exploit does not require local access and is effective against vulnerable, internet-accessible Grafana Enterprise deployments with the relevant configuration. The repository is well-structured, with clear usage instructions and mitigation guidance in the README. No fake or malicious code is present; the exploit is a legitimate PoC for authorized testing.

This repository provides a proof-of-concept exploit for CVE-2025-41115, a vulnerability in the SCIM component of Grafana Enterprise (version 12.x+). The exploit targets a misconfiguration in user identity management that allows an attacker to override internal user IDs via the SCIM API, potentially leading to privilege escalation or impersonation. The repository is structured into two main parts: - `stand/`: Contains Docker-based infrastructure to deploy a vulnerable Grafana instance, including configuration files (`grafana.ini`), a script to initialize a service account and obtain a token (`init.sh`), and a placeholder for the required Grafana Enterprise license (`license.jwt`). - `exploit/`: Contains the exploit code (`src/main.py`), configuration files (`resource/config.toml`), and Python project dependencies. The exploit script reads configuration from `config.toml`, including the target URL, service account token, and user details, then sends a crafted POST request to the SCIM API endpoint (`/api/scim/v2/Users`) to create or override a user. The exploit requires a valid service account token, which is obtained by running the initialization script in the stand. The attack vector is network-based, targeting the SCIM API over HTTP. The exploit is a proof-of-concept and demonstrates the vulnerability by creating or overriding a user in the target Grafana instance.

This repository contains a proof-of-concept (PoC) exploit for CVE-2025-41115, a critical privilege escalation vulnerability in Grafana Enterprise's SCIM user provisioning feature. The exploit is implemented in a single Python script (CVE-2025-41115.py) and is accompanied by a detailed README.md explaining the vulnerability, affected versions, exploitation steps, and mitigation advice. The exploit works by sending a crafted POST request to the SCIM API endpoint (/api/scim/v2/Users) with a numeric 'externalId' set to '1', which Grafana maps to the internal admin user (UID 1). If a valid or leaked SCIM token is provided, the script can overwrite the admin account, allowing the attacker to log in as an admin with any password. The script tries several default/leaked tokens and prints a success message if exploitation is successful. The repository is well-structured for PoC use, with clear instructions and a single Python file as the entry point. No detection or fake code is present; the exploit is functional and targets a real vulnerability. The attack vector is network-based, requiring access to the Grafana SCIM API and a valid or leaked SCIM token. The only fingerprintable endpoint is the SCIM user creation API path. The exploit is classified as a PoC, as it demonstrates the vulnerability and provides admin access but does not include weaponized or framework-level features.

This repository contains a proof-of-concept (PoC) exploit for CVE-2025-41115, a critical privilege escalation vulnerability in Grafana Enterprise's SCIM user provisioning feature. The exploit is implemented in a single Python script (CVE-2025-41115.py) and is accompanied by a detailed README.md explaining the vulnerability, affected versions, exploitation steps, and mitigation advice. The exploit works by sending a crafted POST request to the SCIM API endpoint (/api/scim/v2/Users) with a numeric 'externalId' set to '1', which Grafana maps to the internal admin user (UID 1). If a valid or leaked SCIM token is provided, the script can overwrite the admin account, allowing the attacker to log in as an admin with any password. The script tries several default/leaked tokens and prints a success message if exploitation is successful. The repository is well-structured for PoC use, with clear instructions and a single Python file as the entry point. No detection or fake code is present; the exploit is functional and targets a real vulnerability. The attack vector is network-based, requiring access to the Grafana SCIM API and a valid or leaked SCIM token. The only fingerprintable endpoint is the SCIM user creation API path. The exploit is classified as a PoC, as it demonstrates the vulnerability and provides admin access but does not include weaponized or framework-level features.