# 0-day Cross Origin Request Forgery vulnerability in Grafana 8.x .

Grafana's grafana_session cookie uses SameSite=Lax, letting a malicious Grafana instance CSRF authenticated victims into creating admin invites and dashboards.

- Payout: hidden
- Severity: high
- Program: Aiven Ltd
- Found by: abrahack
- Disclosed: 2022-03-16
- CVE: CVE-2022-21703
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/1458236
- Library page: https://bugbountylibrary.com/r/h1%3A1458236
- Tags: area:web domain:web impact:integrity impact:privesc kind:bounty platform:hackerone sev:high tech:go technique:chained technique:source-review vuln:csrf vuln:ssrf

**Target:** Grafana web API (/api/org/invites, /api/dashboards/db) on Aiven-hosted instances
**Root cause:** Grafana sets grafana_session with SameSite=Lax; combined with allow_embedding and cookie_samesite=none on attacker instance, cross-origin POSTs from an attacker-controlled Grafana origin carry the victim's session cookie.
**Steps:**
1. Create attacker and victim Grafana instances on Aiven console.
2. On attacker instance set allow_embedding and cookie_samesite=none via advanced config.
3. Log into attacker instance, copy grafana_session cookie value.
4. Host payload HTML that fetches victim `/api/org/invites` and `/api/dashboards/db` with `mode:no-cors, credentials:include`, Content-Type `text/plain; application/json`.
5. Create SSRF datasource on attacker instance pointing to payload URL via `POST /api/datasources` with `access:proxy`, note `/api/datasources/proxy/{id}`.
6. Host login-CSRF page that auto-submits form to attacker `/login` inside iframe, then redirects victim to SSRF proxy URL.
7. Send link to logged-in victim; victim is logged into attacker instance then redirected to payload, triggering CSRF against victim instance.
8. Verify new dashboard `grafana_csrf_0_day` and pending invite for attacker@example.com on victim instance.
**How found:** Researchers noted Grafana's grafana_session cookie is SameSite=Lax (per jub0bs' SameSite confusion research) and that Aiven allows per-instance cookie_samesite=none plus allow_embedding, enabling cross-origin credentialed requests between tenant subdomains.
**Exploitation:** Attacker lures authenticated Grafana admin to a page; login-CSRF logs victim into attacker's Grafana instance, then redirects to an attacker-controlled SSRF datasource proxy that serves the CSRF payload from the attacker's origin, causing victim's browser to POST to the victim instance with credentials included, creating an Admin invite and dashboard.
**Escalation:** Chained login CSRF + SSRF datasource proxy to bypass origin restrictions, escalating to Organization Admin access on the victim instance.
**Insight:** Multi-tenant SaaS hosting the same app on sibling subdomains is a CSRF goldmine: check whether per-tenant config (cookie_samesite, allow_embedding) lets an attacker tenant weaken cookie protections, and abuse the app's own SSRF/proxy endpoints to serve payloads from a trusted origin.