Description
Grafana 是一个开源的分析和监控平台。该漏洞存在于 Grafana 的 avatar 功能中，攻击者可以通过构造恶意的 URL 利用 SSRF 漏洞发送任意请求，可能导致敏感信息泄露。此外，该漏洞还可能被利用进行拒绝服务攻击，影响系统的正常运行。
Grafana /avatar 服务器端请求伪造漏洞（CVE-2020-13379）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2020-13379
https://rhynorater.github.io/CVE-2020-13379-Write-Up
https://grafana.com/blog/2020/06/03/grafana-6.7.4-and-7.0.2-released-with-important-security-fix/
https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-13379.yaml
https://www.exploit-db.com/exploits/48638
https://mostwanted002.gitlab.io/post/grafanados/
https://access.redhat.com/security/cve/CVE-2020-13379
https://www.cnblogs.com/KHZ521/p/14333125.html
https://szczecin.github.io/2024/01/19/CVE-2020-13379-Grafana/