PoC for CVE-2021-43798

Grafana is an open-source platform for monitoring and observability. Grafana versions from 8.0.0-beta1 to 8.3.0 (except patched versions) are vulnerable to directory traversal, allowing access to local files. The vulnerable URL is: <grafana_host_url>/public/plugins//, where is the plugin ID for any installed plugin. At no time was Grafana Cloud vulnerable. Users are recommended to upgrade to patched versions 8.0.7, 8.1.8, 8.2.7, or 8.3.1.

This Python script is a proof of concept (PoC) to exploit the CVE-2021-43798 vulnerability in Grafana.

Pre-requisites

• Python 3
• A system with Grafana vulnerable to CVE-2021-43798
• Docker (only if you want to set up the test lab)

Usage

To run this script, first clone the repository and move to the project directory:

git clone https://github.com/FAOG99/GrafanaDirectoryScanner.git
cd GrafanaDirectoryScanner

Set up test lab

If you want to set up a vulnerable lab, follow these steps:

cd CVE-2021-43798
docker-compose up -d

After the server starts, you can navigate to http://localhost:3000 to access the login page. No credentials are needed for this exploit.

Running the exploit

Then you can run the script using Python 3.

Remember to run the exploit from the correct path (if you entered the lab folder, remember to go back to the root folder)

The required arguments are -d to specify the domain or IP of the site, -p to specify the port, and -f to enter the path of the file you want to search (if you do not use this option, it will use /etc/passwd by default). Here is an example:

python3 GrafanaDirectoryScanner -d dominio.com -p 80 -f /etc/passwd

If the script finds the file and can read it, it will print the file's contents. If it cannot find the file, it will print an error message.

Example