.. / CVE-2021-43798

Exploit for Grafana v8.x - Arbitrary File Read (CVE-2021-43798)

Description:

Grafana versions 8.0.0-beta1 through 8.3.0 are vulnerable to a local directory traversal, allowing access to local files. The vulnerable URL path is /public/plugins/NAME/, where NAME is the plugin ID for any installed plugin.

Proof of Concept

PoC exploit

Nuclei Template

View the template here CVE-2021-43798.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2021/CVE-2021-43798.yaml
Copy

Try the exploit in a lab environment:

Lab Machine Link
Hack The Box Ambassador Go to Practice

References:

https://nosec.org/home/detail/4914.html
https://github.com/jas502n/Grafana-VulnTips
http://packetstormsecurity.com/files/165198/Grafana-Arbitrary-File-Reading.html
https://nvd.nist.gov/vuln/detail/CVE-2021-43798
https://github.com/grafana/grafana/security/advisories/GHSA-8pjx-jj86-j47p