CVE-2021-43798 PoC — Grafana path traversal

Source

https://github.com/light-Life/CVE-2021-43798

Associated Vulnerability

Title:Grafana path traversal (CVE-2021-43798)
Description:Grafana is an open-source platform for monitoring and observability. Grafana versions 8.0.0-beta1 through 8.3.0 (except for patched versions) iss vulnerable to directory traversal, allowing access to local files. The vulnerable URL path is: `<grafana_host_url>/public/plugins//`, where is the plugin ID for any installed plugin. At no time has Grafana Cloud been vulnerable. Users are advised to upgrade to patched versions 8.0.7, 8.1.8, 8.2.7, or 8.3.1. The GitHub Security Advisory contains more information about vulnerable URL paths, mitigation, and the disclosure timeline.

Description

运用golang写的grafana批量验证脚本，内置48个验证

Readme

# CVE-2021-43798
运用golang写的批量验证脚本，内置48个验证<br>
python写的人太多了，试着学学golang
# 食用
把url地址保存为url.txt然后在当前目录运行`go run CVE-2021-43798.go`,有漏洞的地址保存为test.txt
![](https://hellohy.top/wp-content/uploads/2022/01/image-35-1024x580.png)
# 利用

验证存在后访问 var/lib/grafana/grafana.db
即可下载这个数据库文件打开 user 的表
![](https://hellohy.top/wp-content/uploads/2022/01/image-32-1024x245.png)
密码是加了盐的，一般无法破解（加盐是为了应对短密码被彩虹表爆出来也就是碰撞盐（salt）是个随机值，加密大概公式为 md5 (md5 (passwd)+salt) 每多一位破解难度成指数上升）<br>
发现这 login 为 admin 的一般密码也为 admin<br>
登录进去即可，记得改 ip 或在虚拟机登录，后台会有详细记录的<br>
![](https://hellohy.top/wp-content/uploads/2022/01/image-33-1024x179.png)

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!