Skip to content

A PoC exploit for CVE-2021-43798 - Grafana Directory Traversal

Notifications You must be signed in to change notification settings

K3ysTr0K3R/CVE-2021-43798-EXPLOIT

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

8 Commits
 
 
 
 

Repository files navigation

CVE-2021-43798 - Grafana Directory Traversal 🔍

Grafana is an open-source platform for monitoring and observability. Versions 8.0.0-beta1 through 8.3.0 (except for patched versions) are vulnerable to a directory traversal attack, allowing unauthorized access to local files. This vulnerability does not affect Grafana Cloud. The vulnerability exists in the handling of the URL path <grafana_host_url>/public/plugins//. By manipulating the <plugin_id> parameter, an attacker can traverse directories and access files outside the intended directory.

Impact 💥

An attacker could exploit this vulnerability to access sensitive files on the host system, potentially leading to further compromise of the Grafana instance or the host system itself.

Affected Versions ❗️

Grafana versions 8.0.0-beta1 through 8.3.0 (except for patched versions) are affected by this vulnerability.

Disclaimer 🚨

This exploit is intended for educational purposes only. Misuse of this exploit or any information related to it is not condoned and is the sole responsibility of the user.