CVE-2021-43798 PoC — Grafana 路径遍历漏洞

Description

Automated path traversal testing tool for Grafana plugin endpoints using curl and Bash.

介绍

# Grafana Path Traversal Tester

This script automates the testing of known Grafana plugin endpoints for potential path traversal vulnerabilities using `curl`.

## 🛠 Features

- Reads target paths from a file (e.g. `paths.txt`)
- Sends HTTP requests using `--path-as-is` to bypass normalization
- Captures HTTP status codes and response bodies
- Saves only successful responses (HTTP 200) to individual files
- Silent and clean output for easy triaging

## 📂 Output

Successful hits are saved in the `hits/` directory with safe, readable filenames derived from the path.

## 🚀 Usage

1. Add your list of paths (relative to the plugin directory) to `paths.txt`
2. Run the script:

```bash
chmod +x grafana-cve-2021-43798.sh
./grafana-cve-2021-43798.sh

文件快照

备注