CVE-2021-27358
📋 TL;DR
This vulnerability in Grafana's snapshot feature allows unauthenticated remote attackers to trigger a Denial of Service via API calls when a commonly used configuration is enabled. It affects Grafana instances running versions 6.7.3 through 7.4.1 with the snapshot feature accessible.
💻 Affected Systems
- Grafana
📦 What is this software?
Grafana by Grafana
⚠️ Risk & Real-World Impact
Worst Case
Complete service unavailability for Grafana dashboards and monitoring capabilities, disrupting business operations and visibility.
Likely Case
Temporary service degradation or downtime for Grafana, affecting dashboard access and monitoring data visualization.
If Mitigated
Minimal impact with proper network segmentation and authentication controls preventing unauthenticated access.
🎯 Exploit Status
Exploitation requires only API access to the snapshot feature without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 7.4.2
Vendor Advisory: https://grafana.com/docs/grafana/latest/release-notes/release-notes-7-4-2/
Restart Required: Yes
Instructions:
1. Backup current Grafana configuration and data. 2. Stop Grafana service. 3. Upgrade to Grafana 7.4.2 or later using your package manager or download from grafana.com. 4. Restart Grafana service. 5. Verify service is running and accessible.
🔧 Temporary Workarounds
Disable snapshot API access
linuxRestrict or disable access to the snapshot API endpoints to prevent exploitation.
# Configure firewall rules to block access to snapshot endpoints
# Example: iptables -A INPUT -p tcp --dport 3000 -m string --string "/api/snapshots" --algo bm -j DROP
Enable authentication requirements
allEnsure all API endpoints require authentication, preventing unauthenticated access.
# Configure auth in grafana.ini: [auth]
enabled = true
# Ensure [security] section has: allow_embedding = false
🧯 If You Can't Patch
- Implement network segmentation to restrict access to Grafana instances only to authorized users and systems.
- Deploy Web Application Firewall (WAF) rules to detect and block malicious API calls to snapshot endpoints.
🔍 How to Verify
Check if Vulnerable:
Check Grafana version: grafana-server -v. If version is between 6.7.3 and 7.4.1 inclusive, and snapshot feature is enabled, the system is vulnerable.Check Version:
grafana-server -vVerify Fix Applied:
After patching, verify version is 7.4.2 or later with grafana-server -v and test snapshot functionality works normally without service disruption.📡 Detection & Monitoring
Log Indicators:
- Multiple failed or successful API calls to /api/snapshots endpoints from unauthenticated sources
- Increased error rates or service restart logs
Network Indicators:
- High volume of requests to Grafana snapshot API endpoints
- Traffic patterns suggesting DoS attack
SIEM Query:
source="grafana.log" AND ("/api/snapshots" OR "snapshot") AND (status=200 OR status=4xx) | stats count by src_ip🔗 References
- https://github.com/grafana/grafana/blob/master/CHANGELOG.md
- https://github.com/grafana/grafana/blob/master/CHANGELOG.md#742-2021-02-17
- https://grafana.com/docs/grafana/latest/release-notes/release-notes-7-4-2/
- https://security.netapp.com/advisory/ntap-20210513-0007/
- https://github.com/grafana/grafana/blob/master/CHANGELOG.md
- https://github.com/grafana/grafana/blob/master/CHANGELOG.md#742-2021-02-17
- https://grafana.com/docs/grafana/latest/release-notes/release-notes-7-4-2/
- https://security.netapp.com/advisory/ntap-20210513-0007/
