CVE-2021-43798 PoC — Grafana path traversal

Source

https://github.com/halencarjunior/grafana-CVE-2021-43798

Associated Vulnerability

Title:Grafana path traversal (CVE-2021-43798)
Description:Grafana is an open-source platform for monitoring and observability. Grafana versions 8.0.0-beta1 through 8.3.0 (except for patched versions) iss vulnerable to directory traversal, allowing access to local files. The vulnerable URL path is: `<grafana_host_url>/public/plugins//`, where is the plugin ID for any installed plugin. At no time has Grafana Cloud been vulnerable. Users are advised to upgrade to patched versions 8.0.7, 8.1.8, 8.2.7, or 8.3.1. The GitHub Security Advisory contains more information about vulnerable URL paths, mitigation, and the disclosure timeline.

Readme

# Grafana CVE Scan 21-43798 0.1
#### Scanner for Grafana Path Traversal Vulnerability found in CVE-2021-43798

Disclaimer: This is for Educational Purposes only!

[![License: GPL v3](https://img.shields.io/badge/License-GPL%20v3-blue.svg)](http://www.gnu.org/licenses/gpl-3.0)

## References for CVE:

  [1 - NIST CVE Details ](https://nvd.nist.gov/vuln/detail/CVE-2021-43798)

  [2 - Grafana Notes](https://grafana.com/blog/2021/12/07/grafana-8.3.1-8.2.7-8.1.8-and-8.0.7-released-with-high-severity-security-fix/)

## Workarounds

All installations between v8.0.0-beta1 and v8.3.0 should be upgraded as soon as possible.

If you cannot upgrade, running a reverse proxy in front of Grafana that normalizes the PATH of the request will mitigate the vulnerability. For example, the normalize_path setting in envoy.

Thanks to our defense-in-depth approach, Grafana Cloud instances have not been affected by the vulnerability.

As always, we closely coordinated with all cloud providers licensed to offer Grafana Pro. They have received early notification under embargo and confirmed that their offerings are secure at the time of this announcement. In alphabetical order, this is applicable to Amazon Managed Grafana and Azure Managed Grafana.

## Usage:

    $ grafana-CVE-2021-43798 [FLAGS] [OPTIONS]

## FLAGS:

    -c, --check      Just check for Vulnerability
        --help       Prints help information
    -n, --nossl      Use http:// instead https:// on URL
    -V, --version    Prints version information

## OPTIONS:

    -f, --file <file>                 File to be read on grafana server
    -H, --host <Host IP or domain>    Host IP or Domain and port e.g. 127.0.0.1:3000 to be checked for CVE
    -h, --hostlist <hostlist>         File containing a list of Hosts 1 per line with ip/domain:port e.g. 127.0.0.1:3000

## Installation

First you must install Rust package on your GNU/Linux distribution, MacOS ($$$$) or Windows (blergh!)

  https://www.rust-lang.org/tools/install

## Compiling 

It is really easy to compile. Just run :

    $ cargo build --release

Then you'll have the release ready in your <repo_downloaded_dir>/target/release/

That's all folks! Thank you very much.

File Snapshot


 [4.0K]  /data/pocs/21afb06035fceeba5ec885e26dd06d17cfe82e1b
├── [ 33K]  Cargo.lock
├── [ 531]  Cargo.toml
├── [  30]  ips.txt
├── [2.1K]  README.md
└── [4.0K]  src
    ├── [3.4K]  chkvuln.rs
    ├── [ 376]  error.rs
    ├── [5.0K]  main.rs
    └── [ 768]  plugins.rs

1 directory, 8 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!