Exploitation Summary
CVE-2025-4123 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 10 public exploits from researchers including Beatriz Fresno Naumova, NightBloodZ, ynsmroztas. A Nuclei detection template is also available.
AI-analyzed exploit summary The exploit demonstrates an SSRF vulnerability in Grafana versions 11.2.0 to 11.6.0 via path traversal encoding and open redirect in the `render/public` endpoint. The provided HTTP requests show how an attacker can manipulate the server into making requests to arbitrary domains.
Description
A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a frontend plugin that will execute arbitrary JavaScript. This vulnerability does not require editor permissions and if anonymous access is enabled, the XSS will work. If the Grafana Image Renderer plugin is installed, it is possible to exploit the open redirect to achieve a full read SSRF. The default Content-Security-Policy (CSP) in Grafana will block the XSS though the `connect-src` directive.
Exploits (10)
The exploit demonstrates an SSRF vulnerability in Grafana versions 11.2.0 to 11.6.0 via path traversal encoding and open redirect in the `render/public` endpoint. The provided HTTP requests show how an attacker can manipulate the server into making requests to arbitrary domains.
This PoC demonstrates a combined SSRF and XSS vulnerability in Grafana (CVE-2025-4123) by serving malicious JavaScript and a fake plugin via a Flask server. The exploit leverages path traversal to trigger the vulnerabilities.
This is a functional proof-of-concept exploit for CVE-2025-4123, a path traversal vulnerability in Grafana's `/public` endpoint. It demonstrates SSRF, LFI, open redirect, and XSS attacks via crafted URLs with encoded path traversal sequences.
This repository provides a proof-of-concept for CVE-2025-4123, demonstrating SSRF and Open Redirect vulnerabilities in Grafana. The exploit leverages path traversal techniques to achieve these attacks.
This repository contains a Go-based tool that scans for CVE-2025-4123 by sending a crafted path traversal payload and checking for 301/302 redirect responses. It does not exploit the vulnerability but detects potential exposure by analyzing the `Location` header.
The repository contains only a README.md file with a placeholder title and no exploit code or technical details. It appears to be an empty template or placeholder for CVE-2025-4123.
The repository contains a path traversal exploit for CVE-2025-4123, demonstrating directory traversal sequences that could be used to access unauthorized files or directories. The payloads suggest an SSRF or directory traversal vulnerability.
The repository contains only a README with path traversal payloads for CVE-2025-4123, but no actual exploit code or technical details. It appears to be a placeholder or incomplete PoC.
This repository contains a functional exploit for CVE-2025-4123, targeting Grafana versions 11.2 to 12.0. The exploit leverages SSRF and XSS vulnerabilities via crafted paths and a malicious server to deliver payloads.
Nuclei Templates (1)
product:"Grafana"
app="Grafana"
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L