VYPR
← All advisories
Moderate severityNVD Advisory· Published Jun 3, 2020· Updated Aug 4, 2024

CVE-2020-13379

CVE-2020-13379

Description

The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. This vulnerability allows any unauthenticated user/client to make Grafana send HTTP requests to any URL and return its result to the user/client. This can be used to gain information about the network that Grafana is running on. Furthermore, passing invalid URL objects could be used for DOS'ing Grafana via SegFault.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Unauthenticated SSRF in Grafana avatar feature (3.0.1–7.0.1) allows attackers to probe internal networks and cause denial of service.

Vulnerability

Overview The avatar feature in Grafana versions 3.0.1 through 7.0.1 contains a Server-Side Request Forgery (SSRF) vulnerability due to improper access control [1]. The /avatar/:hash endpoint takes a user-supplied hash and forwards it to secure.gravatar.com without sufficient validation [3]. Because the hash parameter is URL-decoded before being appended to the gravatar URL, an attacker can inject arbitrary query parameters [3].

Exploitation and

Attack Surface An unauthenticated attacker can send a specially crafted request to the /avatar/:hash endpoint, causing Grafana to make an HTTP request to an attacker-controlled URL [1]. By chaining the URL parameter injection with an open redirect on i0.wp.com (a CDN used by Gravatar), the request can be redirected to any arbitrary host [3]. No authentication is required, and the attacker only needs network access to the Grafana instance [1].

Potential

Impact Successful exploitation allows an attacker to probe internal networks accessible from the Grafana server, potentially discovering services or sensitive infrastructure [1]. Additionally, passing invalid URL objects can cause Grafana to crash via a segmentation fault (SegFault), leading to a denial of service [1].

Mitigation and

Patch Status Grafana addressed this vulnerability in version 7.0.1 [2]. Users running versions 3.0.1 through 7.0.0 should upgrade to version 7.0.1 or later [2]. As of the publication date, this vulnerability is not known to be listed in the CISA Known Exploited Vulnerabilities catalog, but it is remotely exploitable and should be prioritized for patching in exposed environments.

References
  1. NVD - CVE-2020-13379
  2. Release Notes v7.0.x
  3. CVE-2020-13379

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
github.com/grafana/grafanaGo
>= 3.0.1, < 6.7.46.7.4
github.com/grafana/grafanaGo
>= 7.0.0, < 7.0.27.0.2

Affected products

398

Patches

1
ba953be95f03

Only allow 32 hexadecimal digits for the avatar hash (#25322)

https://github.com/grafana/grafanaMarcus EfraimssonJun 3, 2020via ghsa
commit
1 file changed · +11 −5
  • pkg/api/avatar/avatar.go+11 −5 modified
    @@ -15,14 +15,14 @@ import (
 	"net/http"
 	"net/url"
 	"path/filepath"
+	"regexp"
 	"strconv"
-	"strings"
 	"sync"
 	"time"
 
 	"github.com/grafana/grafana/pkg/infra/log"
+	"github.com/grafana/grafana/pkg/models"
 	"github.com/grafana/grafana/pkg/setting"
-	"gopkg.in/macaron.v1"
 
 	gocache "github.com/patrickmn/go-cache"
 )
@@ -73,9 +73,15 @@ type CacheServer struct {
 	cache    *gocache.Cache
 }
 
-func (this *CacheServer) Handler(ctx *macaron.Context) {
-	urlPath := ctx.Req.URL.Path
-	hash := urlPath[strings.LastIndex(urlPath, "/")+1:]
+var validMD5 = regexp.MustCompile("^[a-fA-F0-9]{32}$")
+
+func (this *CacheServer) Handler(ctx *models.ReqContext) {
+	hash := ctx.Params("hash")
+
+	if len(hash) != 32 || !validMD5.MatchString(hash) {
+		ctx.JsonApiErr(404, "Avatar not found", nil)
+		return
+	}
 
 	var avatar *Avatar
 	obj, exists := this.cache.Get(hash)

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

49

News mentions

0

No linked articles in our index yet.