CVE-2021-43798 PoC — Grafana path traversal

Source

Associated Vulnerability

Description

Exploit for CVE-2021-43798

Readme

# CVE-2021-43798

This is a script to exploit CVE-2021-43798 a directory traversal vulnerability in Grafana versions from 8.0.1-beta1 through 8.3.0.

## Usage

To use this script simply supply the base URL of the target Grafana instance that you would like to exploit.

```bash
python3 exploit.py --url http://localhost:3000 --file  /etc/passwd
```

This will write the output to stdout but if you'd like to write the output directly to disk instead you can do so with the `--output` flag

## Example

```bash
$ python3 exploit.py --url http://localhost:3000 --file /var/lib/grafana/grafana.db --output ./grafana.db
[+] Target is vulnerable!
[+] Successfully wrote file to /etc/passwd
```

## Disclaimer

This script is for educational and security assessment purposes only and should not be used in any malicious way. The author of this script is not responsible for any misuse of this tool.

## References

- https://nvd.nist.gov/vuln/detail/CVE-2021-43798
-

File Snapshot

 [4.0K]  /data/pocs/ff96a4887b0542d255d1c55a40716de842a83642
├── [1.9K]  cve_2023_43789.py
└── [ 961]  README.md

0 directories, 2 files

Remarks