CVE-2021-43798 PoC — Grafana path traversal

Source

Associated Vulnerability

Title:Grafana path traversal (CVE-2021-43798)
Description:Grafana is an open-source platform for monitoring and observability. Grafana versions 8.0.0-beta1 through 8.3.0 (except for patched versions) iss vulnerable to directory traversal, allowing access to local files. The vulnerable URL path is: `<grafana_host_url>/public/plugins//`, where is the plugin ID for any installed plugin. At no time has Grafana Cloud been vulnerable. Users are advised to upgrade to patched versions 8.0.7, 8.1.8, 8.2.7, or 8.3.1. The GitHub Security Advisory contains more information about vulnerable URL paths, mitigation, and the disclosure timeline.

Description

Automated Exploit Tool for Grafana CVE-2021-43798: Scanning common files that contain juicy informations and extracting SSH keys from compromised users.

Readme

# Automated Exploit Tool for Grafana CVE-2021-43798
![Preview](image.jpg)

## Overview

This project is an automated exploit tool designed to scan for and extract sensitive information from compromised Grafana instances vulnerable to CVE-2021-43798. The tool identifies vulnerable plugins and extracts SSH keys from compromised users.

## Features

- Automated scanning for vulnerable Grafana instances.
- Identification of vulnerable plugins.
- Extraction of sensitive files, including SSH keys.
- Support for single and multiple target scanning.
- Customizable path lists for scanning.

## Prerequisites

- Python 3.x
- Required Python libraries: `colorama`

## Installation

1. Clone the repository:
    ```sh
    git clone https://github.com/hxlxmjxbbxs/grafxploit.git
    cd grafxploit
    ```

2. Install the required Python library:
    ```sh
    pip install colorama
    ```

## Usage

The tool can be run with various command-line options to specify targets, output directories, and additional paths to scan.

### Command-Line Options

- `-t`, `--target`: Check a single target in the format `proto://ip:port`.
- `-i`, `--input-targets`: Check multiple targets from a file in the format `proto://ip:port`.
- `-o`, `--output`: Directory to download the files if found.
- `-p`, `--paths`: File containing additional paths to check (default: `common/paths.txt`).

### Examples

1. Scan a single target:
    ```sh
    python grafxploit.py -t http://192.168.1.100:3000
    ```

2. Scan multiple targets from a file:
    ```sh
    python grafxploit.py -i targets.txt
    ```

3. Specify an output directory for downloaded files:
    ```sh
    python grafxploit.py -t http://192.168.1.100:3000 -o output_directory
    ```

## Developed by

Halim Jabbes

- LinkedIn: [Halim Jabbes](https://www.linkedin.com/in/hxlxmj)

## Release Date

22-07-2024

File Snapshot


 [4.0K]  /data/pocs/ada6320e73e5d0d10daf759b32f658ffdd5bd5aa
├── [4.0K]  common
│   └── [ 834]  paths.txt
├── [ 10K]  grafxploit.py
├── [543K]  image.jpg
├── [1.0K]  LICENSE
└── [1.8K]  README.md

1 directory, 5 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!