Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%

CVE-2021-43798 PoC — Grafana path traversal

Source
Associated Vulnerability
Title:Grafana path traversal (CVE-2021-43798)
Description:Grafana is an open-source platform for monitoring and observability. Grafana versions 8.0.0-beta1 through 8.3.0 (except for patched versions) iss vulnerable to directory traversal, allowing access to local files. The vulnerable URL path is: `<grafana_host_url>/public/plugins//`, where is the plugin ID for any installed plugin. At no time has Grafana Cloud been vulnerable. Users are advised to upgrade to patched versions 8.0.7, 8.1.8, 8.2.7, or 8.3.1. The GitHub Security Advisory contains more information about vulnerable URL paths, mitigation, and the disclosure timeline.
Description
Script to demonstrate the Grafana directory traversal exploit (CVE-2021-43798).
Readme
# Grafana CVE-2021-43798 Exploit Script

Script to demonstrate the Grafana directory traversal exploit (CVE-2021-43798) that affects Grafana versions 8.0.0-beta1 through 8.3.0.
Primarily used for a demonstration in a CTF. Written in python with standard library modules only. Only use this for   legitimate purposes e.g testing and CTFs please.

## Installation

``` bash
wget https://raw.githubusercontent.com/Jroo1053/GrafanaDirInclusion/master/exploit.py
```
## Usage

```bash

usage: exploit.py [-h] -u TARGET_URL -p TARGET_PORT [-o OUTPUT_FILE] -f TARGET_FILE

Grafana CVE-2021-43798 (File Read Exploit)

optional arguments:
  -h, --help      show this help message and exit
  -u TARGET_URL   Target URL
  -p TARGET_PORT  Target Port
  -o OUTPUT_FILE  Output File
  -f TARGET_FILE  Remote File To Read

```
File Snapshot

[4.0K] /data/pocs/13c55fa210750b2f4d708536a38b06572b02bc28 ├── [ 812] README.md ├── [ 13] requirements.txt ├── [4.0K] src │   └── [4.6K] exploit.py ├── [4.0K] test │   └── [ 609] test_script.py └── [1.2K] UNLICENSE 2 directories, 5 files
Shenlong Bot has cached this for you
Remarks
    1. It is advised to access via the original source first.
    2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.
    3. Mirroring, verifying, and maintaining this POC archive takes ongoing effort, so local snapshots are a paid feature. Your subscription keeps the archive online — thank you for the support. View subscription plans →