mirror of
https://github.com/lunchcat/sif.git
synced 2026-07-28 14:37:01 -07:00
TigahandGitHub
551c89ad0d
add a recon module for a grafana with anonymous access enabled: by default grafana requires a login and /api/search returns 401, but when anonymous access is turned on the endpoint lists every dashboard without credentials, exposing the internal metrics, hostnames and queries they contain, and the same anonymous session can reach backend data sources through the data source proxy; a grafana that requires login returns 401 and is not flagged.
42 lines
890 B
YAML
42 lines
890 B
YAML
# Grafana Anonymous Access Exposure Detection Module
|
|
|
|
id: grafana-anonymous-exposure
|
|
info:
|
|
name: Grafana Anonymous Access Exposure
|
|
author: sif
|
|
severity: medium
|
|
description: Detects a Grafana with anonymous access enabled that lists every dashboard and reaches backend data sources without login
|
|
tags: [grafana, dashboard, observability, anonymous, misconfiguration, exposure, unauth, recon]
|
|
|
|
type: http
|
|
|
|
http:
|
|
method: GET
|
|
paths:
|
|
- "{{BaseURL}}/api/search?type=dash-db"
|
|
|
|
matchers:
|
|
- type: regex
|
|
part: body
|
|
regex:
|
|
- '"type"\s*:\s*"dash-db"'
|
|
|
|
- type: word
|
|
part: body
|
|
words:
|
|
- "\"uri\""
|
|
- "\"isStarred\""
|
|
condition: and
|
|
|
|
- type: status
|
|
status:
|
|
- 200
|
|
|
|
extractors:
|
|
- type: regex
|
|
name: grafana_dashboard
|
|
part: body
|
|
regex:
|
|
- '"title"\s*:\s*"([^"]+)"'
|
|
group: 1
|