Loading vulnerability…
CVE-2025-4123 is a Grafana vulnerability in which a client-side path traversal condition can be combined with an open redirect to send users to attacker-controlled content that hosts a malicious frontend plugin. When the victim follows a crafted Grafana URL, the browser can be redirected in a way that results in execution of attacker-supplied JavaScript in the Grafana context. The issue does not require editor permissions to exploit, and the provided content states that exploitation works when anonymous access is enabled. The same redirect primitive can also be abused for full-read SSRF when the Grafana Image Renderer plugin is installed. The content further notes that Grafana’s default Content-Security-Policy blocks the XSS through the connect-src directive, but multiple sources in the provided material still describe practical account-takeover risk from malicious plugin loading and session hijacking.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
3 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (5 hidden).
This repository provides a proof-of-concept exploit for CVE-2025-4123, a high-severity vulnerability in Grafana (versions 11.2 through 12.0) that enables both Server-Side Request Forgery (SSRF) and Cross-Site Scripting (XSS) attacks. The main file, CVE-2025-4123.py, is a Python Flask application that acts as a malicious server. It serves attacker-controlled JavaScript (for XSS) and JSON (for SSRF) payloads, with the attacker host configurable via command-line argument. The exploit leverages path traversal and open redirect vulnerabilities in Grafana to redirect users or the server to attacker-controlled content. The README.md provides detailed usage instructions, affected versions, and example routes for triggering the XSS and SSRF. The exploit is a POC and requires the attacker to run the Flask server and direct vulnerable Grafana instances to it using crafted URLs. No hardcoded external endpoints are present beyond the default localhost, but the attacker can specify any host. The repository is structured simply, with one Python exploit file and a README.
This repository provides a working exploit for CVE-2025-4123, a high-severity vulnerability in Grafana (versions 11.2 through 12.0) that enables Server-Side Request Forgery (SSRF) and Cross-Site Scripting (XSS). The repository contains a Python server (server.py) that serves attacker-controlled payloads, including a fake plugin manifest (data2.json) and a malicious JavaScript file (js.js). The exploit works by tricking the target Grafana instance into loading a plugin or resource from the attacker's server, which then delivers a JavaScript payload. This payload attempts to change the victim's account details by making an authenticated PUT request to the Grafana API endpoint /api/user, leveraging the victim's session. The server.py script prints out the exact routes to use for XSS and SSRF exploitation, and can be configured to use any attacker-controlled host. The repository is operational and provides all necessary components to demonstrate the exploit in a test environment.
This repository contains a proof-of-concept Python exploit for CVE-2025-4123, a path traversal vulnerability in Grafana's /public endpoint. The exploit (cve_2025_4123_exploit-mitsec.py) is an interactive CLI tool that allows the user to select between four attack modes: SSRF, LFI, open redirect, and XSS. The tool constructs malicious URLs by encoding traversal sequences and user-supplied input, then sends HTTP requests to the target Grafana instance. The README provides detailed usage instructions and example payloads for each attack type. The code is straightforward, using the requests library to interact with the target and print responses. The main entry point is the Python script, which guides the user through attack selection and payload customization. No hardcoded endpoints are present, but the payloads are constructed to target internal services (e.g., 169.254.169.254 for SSRF), local files (e.g., /etc/passwd for LFI), or inject JavaScript for XSS. The exploit is a functional PoC and does not include advanced payload customization or automation beyond interactive input.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
45 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Grafana cross-site scripting vulnerability referenced in scanning payload tags.
A Grafana vulnerability referenced as 'Path Traversal XSS' that appears in scanning activity across multiple IPs.
A previous Grafana vulnerability referenced as having similar attack-chaining patterns to achieve XSS, but not otherwise described in detail.
A previously disclosed and patched high-severity Grafana vulnerability referenced as part of vendor security history, with no technical details provided in the content.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.