Exploiting SQL Injection
Vulnerabilities in Grafana:
Development of a
Metasploit Module
Master Project - February 2024
Authors :
TLILI Mohamed Abdelhamid
mohamed.tlili@stud.acs.upb.ro
ELMOUHAJER Elyes
elyes.el@stud.acs.upb.ro
GHARBI Moumine
moumine.gharbi@stud.acs.upb.ro
Scientific Advisor :
Adrian Razvan DEACONESCU
01.
Why Grafana
Maers ?
● Open-source platform for monitoring and observability
● Real-time dashboards for metrics visualization
● Integrates with Prometheus, MySQL, PostgreSQL
● Main components:
Frontend (dashboards)
Backend (API)
Alerting engine
Plugin system
02. Security Challenges in
Grafana
● SQL injection vulnerabilities in data source plugins
● Misconfigured plugins and dashboards
● Insecure Prometheus integrations
03.
The Threat in
Action
● Attackers exploit SQL injection in Grafana APIs
● Unauthorized access to sensitive data
● Disrupts monitoring systems
04.
What is Metasploit?
A penetration testing framework.
Key features:
● Exploit modules
● Payload delivery
● Post-exploitation
We extended it with a Grafana-specific scanner.
The Urgent Need
for Grafana
Security
● Grafana OSS lacks robust RBAC, exposing vulnerabilities
05.
● SQL plugins (MySQL, PostgreSQL) risk query exposure
● No existing Metasploit module for platform-specific testing
● Rising cyberattacks target monitoring tools
06.
Main Idea and Goal
Develop a Metasploit module for Grafana vulnerabilities :
●
4-layer design: Connect, Check, Exploit, Store results
●
Probes SQLi, plugin misconfigs, Prometheus integrations
●
Enhances security assessments via Metasploit
07.
Why Our Module Stands
Out
Feature
SQLmap
Burp Suite
Scope
Broad (general
SQLi)
Broad (web app Grafana-specifi
testing)
c
Grafana
focus
Not specific
Not specific
Automated
scans
Manual/semi-au Fully automated
tomated
Automation
Our Module
Highly specific
08.
●
●
●
●
●
How It Works
Authenticate with Grafana instance
Scans for SQL injection, plugin issues
Bypasses RBAC with API keys, tokens
Scan for vulnerabilities
Report findings in JSON
09.
Testing
Environment
● Local Docker and cloud instances
● Grafana versions 7.5.0 to 11.6.0
● Scanned SQLi, plugins, Prometheus
10. Key Results from Local
and Cloud Testing
9 plugin misconfigurations (MySQL, PostgreSQL)
● 6 insecure Prometheus connections
● Local: 9 vulnerabilities (e.g., 7 in Grafana v8.3.0)
● Cloud: Retrieved plugin, dashboard, Prometheus data
●
11.
Impact & Use Cases
● Grafana-specific security audit
● JSON/CSV export for compliance teams
● Penetration testing of Grafana setups
● Vulnerability management for plugins
● Compliance audits for secure deployments
12. Conclusion & What’s
Next
Module is fully functional and extensively tested
● Successfully scanned multiple Grafana versions
● Identified 18+ security issues including plugin misconfigs and SQLi risks
●
RBAC limitations resolved with custom authentication logic and fallback
endpoints
What’s Next :
● Package the module for wider internal use and integration in red team
workflows
Thank You for the attention !
0
