CVE-2021-43798 PoC — Grafana path traversal

Source

Associated Vulnerability

Description

Automated path traversal testing tool for Grafana plugin endpoints using curl and Bash.

Readme

# Grafana Path Traversal Tester

This script automates the testing of known Grafana plugin endpoints for potential path traversal vulnerabilities using `curl`.

## 🛠 Features

- Reads target paths from a file (e.g. `paths.txt`)
- Sends HTTP requests using `--path-as-is` to bypass normalization
- Captures HTTP status codes and response bodies
- Saves only successful responses (HTTP 200) to individual files
- Silent and clean output for easy triaging

## 📂 Output

Successful hits are saved in the `hits/` directory with safe, readable filenames derived from the path.

## 🚀 Usage

1. Add your list of paths (relative to the plugin directory) to `paths.txt`
2. Run the script:

```bash
chmod +x grafana-cve-2021-43798.sh
./grafana-cve-2021-43798.sh

File Snapshot

 [4.0K]  /data/pocs/1be45a239c73bb11be3c0f1aafb8a948be6c758c
├── [1.2K]  grafana-cve-2021-43798.sh
├── [4.0K]  paths.txt
└── [ 760]  README.md

0 directories, 3 files

Remarks