CVE-2021-43798 PoC — Grafana 路径遍历漏洞

Description

CVE-2021-43798 Grafana任意文件读取

介绍

# CVE-2021-43798 Grafana任意文件读取

## 1.installation

```shell
pip3 install -r requirements.txt
```

## 2.Usage

```shell
$ python3 grafana.py -h

   ____  __     __  _____           ____     ___    ____    _           _  _     _____   _____    ___     ___
  / ___| \ \   / / | ____|         |___ \   / _ \  |___ \  / |         | || |   |___ /  |___  |  / _ \   ( _ )
 | |      \ \ / /  |  _|    _____    __) | | | | |   __) | | |  _____  | || |_    |_ \     / /  | (_) |  / _ \
 | |___    \ V /   | |___  |_____|  / __/  | |_| |  / __/  | | |_____| |__   _|  ___) |   / /    \__, | | (_) |
  \____|    \_/    |_____|         |_____|  \___/  |_____| |_|            |_|   |____/   /_/       /_/   \___/


                                        CVE-2021-43798 Grafana任意文件读取
                                                                By:K3rwin
usage: grafana.py [-h] [-u U] [-r R]

命令行传入url参数，-u 指定单个地址，-r 从文件读取批量地址

optional arguments:
  -h, --help  show this help message and exit
  -u U        单个url地址，可尝试49个poc
  -r R        url文件列表，只使用默认poc
```

## 3.example

![image-20211217145217400](README.assets/image-20211217145217400.png)

![image-20211217145143609](README.assets/image-20211217145143609.png)

文件快照

备注