> For the complete documentation index, see [llms.txt](https://0xss0rz.gitbook.io/0xss0rz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://0xss0rz.gitbook.io/0xss0rz/pentest/public-exploit/grafana.md).

# Grafana

Grafana exploits

[![ko-fi](https://ko-fi.com/img/githubbutton_sm.svg)](https://ko-fi.com/Y8Y41FQ2GA)

{% embed url="<https://github.com/trilokdhaked/Bug-Bounty-Methodology/blob/main/Technologies/Grafana.md>" %}

## Scanner

{% embed url="<https://github.com/Zierax/Grafana-Final-Scanner/tree/main>" %}

## CVE-2025-6023 - Open Redirection leading to XSS / ATO

{% embed url="<https://blog.ethiack.com/blog/grafana-cve-2025-6023-bypass-a-technical-deep-dive>" %}

`GET /user/auth-tokens/rotate?redirectTo=/%23/..///attacker.com HTTP/1.1` results in a 302 redirect that is a valid open redirect to attacker.com

## CVE-2025-4123 - SSRF, XSS

**Affected Versions:** Grafana 11.2, Grafana 11.3, Grafana 11.4, Grafana 11.5, Grafana 11.6, Grafana 12.0

Open redirect:

```
https://domain.com/public/..%2F%5coast.pro%2F%3f%2F..%2F..
```

{% embed url="<https://medium.com/@Nightbloodz/grafana-cve-2025-4123-full-read-ssrf-account-takeover-d12abd13cd53>" %}

{% embed url="<https://infosecwriteups.com/how-one-path-traversal-in-grafana-unleashed-xss-open-redirect-and-ssrf-cve-2025-4123-b35245dccaab>" %}

{% embed url="<https://github.com/NightBloodz/CVE-2025-4123>" %}

{% embed url="<https://github.com/ynsmroztas/CVE-2025-4123-Exploit-Tool-Grafana->" %}

## Grafana arbitrary file-read / RCE (CVE-2024-9264)

*Grafana* versions *11.0*.x, 11.1.x and

{% embed url="<https://github.com/nollium/CVE-2024-9264>" %}

Reverse shell:

{% embed url="<https://github.com/z3k0sec/CVE-2024-9264-RCE-Exploit>" %}

<figure><img src="https://4199783661-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFF3hT6DtJlHn9jAel9%2Fuploads%2FjpIxfKMeNTjNK2KYo52E%2Fimage.png?alt=media&amp;token=d77d27ac-7656-49b0-8b06-8fe522eefc00" alt=""><figcaption></figcaption></figure>

## Interesting Books

{% content-ref url="/pages/VVT5FQq9z62bWoNAWCUS" %}
[Interesting Books](/0xss0rz/interesting-books.md)
{% endcontent-ref %}

{% hint style="info" %}
**Disclaimer**: As an Amazon Associate, I earn from qualifying purchases. This helps support this GitBook project at no extra cost to you.
{% endhint %}

* [**The Web Application Hacker’s Handbook**](https://www.amazon.fr/dp/1118026470?tag=0xss0rz-21) The go-to manual for web app pentesters. Covers XSS, SQLi, logic flaws, and more
* [**Bug Bounty Bootcamp: The Guide to Finding and Reporting Web Vulnerabilities**](https://www.amazon.fr/dp/1718501544?tag=0xss0rz-21) Learn how to perform reconnaissance on a target, how to identify vulnerabilities, and how to exploit them
* [**Real-World Bug Hunting: A Field Guide to Web Hacking**](https://www.amazon.fr/dp/1593278616?tag=0xss0rz-21) Learn about the most common types of bugs like cross-site scripting, insecure direct object references, and server-side request forgery.

## Support this Gitbook

I hope it helps you as much as it has helped me. If you can support me in any way, I would deeply appreciate it.

[![ko-fi](https://ko-fi.com/img/githubbutton_sm.svg)](https://ko-fi.com/Y8Y41FQ2GA)

[![buymeacoffee](https://cdn.buymeacoffee.com/buttons/v2/default-yellow.png)](https://buymeacoffee.com/0xss0rz)