id: grafana-login-check

info:
  name: Grafana Login Check
  author: parthmalhotra,pdresearch
  severity: critical
  description: Checks for a valid login on self hosted Grafana instance.
  reference:
    - https://owasp.org/www-community/attacks/Credential_stuffing
  classification:
    cpe: cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    shodan-query: title:"Grafana"
    fofa-query: title="Grafana"
    product: grafana
    vendor: grafana
  tags: self-hosted,creds-stuffing,login-check,grafana,vuln
variables:
  username: "{{username}}"
  password: "{{password}}"

http:
  - raw:
      - |
        POST /login HTTP/1.1
        Host: {{Hostname}}
        accept: application/json, text/plain, */*
        DNT: 1
        content-type: application/json
        Origin: {{BaseURL}}
        Referer: {{BaseURL}}/login
        Cookie: redirect_to=%2F

        {"user":"{{username}}","password":"{{password}}"}

    extractors:
      - type: dsl
        dsl:
          - username
          - password

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'Logged in'

      - type: word
        part: header
        words:
          - 'grafana_session'

      - type: status
        status:
          - 200
# digest: 4a0a00473045022100c242f1dc32858a5a86214b70a8ffd8fd5f2ccc76b2c56a444ca4b4c0f6e6818b0220428f29af4f64f963fbe7f6964ad81d81096cfa4305049d0fc07a2b2ea6b9b34c:922c64590222798bb761d5b6d8e72950