‘Grafana Ghost’ XSS flaw exposes 47,000 servers to account takeover

Based on the PoC shared by OX Security, the exploit leverages a clever combo of client-side path traversal and open-redirect mechanics in Grafana’s staticHandler, the component responsible for serving static files like HTML, CSS, JavaScript, and images from the server to the user’s browser.

A potential attack can have a crafted URL sent to the victim, which takes them to a malicious domain. Once there, users are tricked into loading an unsigned, rogue Grafana plugin without the attacker requiring any editor or admin rights.

Once the plugin loads, it runs attacker-controlled JavaScripts in the victim’s browser, potentially leading to session hijacks, credential theft, creation of admin logins, and modification of dashboards.