pentester.land· Feb 8, 2022· by Julien Cretel (@jub0bs), abrahack (@theabrahack)🔍 CVE-2022-21703

CVE-2022-21703: cross-origin request forgery against Grafana

Target Program: Grafana Labs

🎯 Vulnerability: Server-Side Request Forgery (SSRF)

💡 Defense Fix: Enforce URL whitelisting, block private IP ranges (10.0.0.0/8, 169.254.169.254), and mandate AWS IMDSv2 headers.

#CSRF#SSRF#CVE-2022-21703