关联漏洞
标题：
Grafana 路径遍历漏洞
(CVE-2021-43798)
描述：Grafana是Grafana实验室的一套提供可视化监控界面的开源监控工具。该工具主要用于监控和分析Graphite、InfluxDB和Prometheus等。 Grafana 8.0.0-beta1至8.3.0存在路径遍历漏洞，攻击者可利用该漏洞执行目录遍历攻击，访问本地文件。
描述
A PoC exploit for CVE-2021-43798 - Grafana Directory Traversal
介绍
# CVE-2021-43798 - Grafana Directory Traversal 🔍
Grafana is an open-source platform for monitoring and observability. Versions 8.0.0-beta1 through 8.3.0 (except for patched versions) are vulnerable to a directory traversal attack, allowing unauthorized access to local files. This vulnerability does not affect Grafana Cloud. The vulnerability exists in the handling of the URL path `<grafana_host_url>/public/plugins//`. By manipulating the `<plugin_id>` parameter, an attacker can traverse directories and access files outside the intended directory.
## Impact 💥
An attacker could exploit this vulnerability to access sensitive files on the host system, potentially leading to further compromise of the Grafana instance or the host system itself.
## Affected Versions ❗️
Grafana versions 8.0.0-beta1 through 8.3.0 (except for patched versions) are affected by this vulnerability.
# Disclaimer 🚨
This exploit is intended for educational purposes only. Misuse of this exploit or any information related to it is not condoned and is the sole responsibility of the user.
文件快照
[4.0K] /data/pocs/b14586917a49d6328dc9e9f67b5de88edd2966dc
├── [9.4K] CVE-2021-43798.py
└── [1.1K] README.md
0 directories, 2 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。