← back
CVE-2021-43798

Grafana path traversal

CVSS 7.5 HIGHEPSS 88.8%● KEVCWE-22
In short

Grafana versions 8.0-8.3 have a flaw that allows attackers to access files on the server by manipulating the plugin URL path. This bypasses normal access controls and could expose sensitive data like configuration files or credentials.

Technical detail

Path traversal vulnerability in Grafana's public plugin endpoint allows unauthenticated attackers to read arbitrary files via directory traversal sequences in the plugin ID parameter. The vulnerability affects versions 8.0.0-beta1 through 8.3.0 (excluding patched releases) and requires only network access to the vulnerable endpoint.

Summary generated and translated by AI from the official description.
Grafana is an open-source platform for monitoring and observability. Grafana versions 8.0.0-beta1 through 8.3.0 (except for patched versions) iss vulnerable to directory traversal, allowing access to local files. The vulnerable URL path is: `<grafana_host_url>/public/plugins//`, where is the plugin ID for any installed plugin. At no time has Grafana Cloud been vulnerable. Users are advised to upgrade to patched versions 8.0.7, 8.1.8, 8.2.7, or 8.3.1. The GitHub Security Advisory contains more information about vulnerable URL paths, mitigation, and the disclosure timeline.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
grafana · grafana
public PoCs found — 53
githubgithub.com/jas502n/Grafana-CVE-2021-43798★ 368githubgithub.com/A-D-Team/grafanaExp★ 268githubgithub.com/pedrohavay/exploit-grafana-CVE-2021-43798★ 46githubgithub.com/taythebot/CVE-2021-43798★ 41githubgithub.com/zer0yu/CVE-2021-43798★ 27githubgithub.com/Mr-xn/CVE-2021-43798★ 24githubgithub.com/MoCh3n/CVE-2021-43798-grafana_fileread★ 17githubgithub.com/ScorpionsMAX/CVE-2021-43798-Grafana-POC★ 14githubgithub.com/asaotomo/CVE-2021-43798-Grafana-Exp★ 12githubgithub.com/Mo0ns/Grafana_POC-CVE-2021-43798★ 9githubgithub.com/Sic4rio/Grafana-Decryptor-for-CVE-2021-43798★ 8githubgithub.com/kenuosec/grafanaExp★ 6githubgithub.com/z3n70/CVE-2021-43798★ 5githubgithub.com/K3ysTr0K3R/CVE-2021-43798-EXPLOIT★ 4githubgithub.com/s1gh/CVE-2021-43798★ 4githubgithub.com/hupe1980/CVE-2021-43798★ 3githubgithub.com/0xSAZZAD/Grafana-CVE-2021-43798★ 3githubgithub.com/wezoomagency/GrafXploit★ 3githubgithub.com/Ryze-T/CVE-2021-43798★ 2githubgithub.com/fanygit/Grafana-CVE-2021-43798Exp★ 2githubgithub.com/monke443/CVE-2021-43798★ 2githubgithub.com/lfz97/CVE-2021-43798-Grafana-File-Read★ 1githubgithub.com/LongWayHomie/CVE-2021-43798★ 1githubgithub.com/k3rwin/CVE-2021-43798-Grafana★ 1githubgithub.com/Jroo1053/GrafanaDirInclusion★ 1githubgithub.com/FAOG99/GrafanaDirectoryScanner★ 1githubgithub.com/wagneralves/CVE-2021-43798★ 1githubgithub.com/Strikoder-Premium/Grafana-Password-Decryptor★ 1githubgithub.com/Asbawy/GrafTraverse-CVE-2021-43798★ 0githubgithub.com/katseyres2/CVE-2021-43798★ 0githubgithub.com/Iris288/CVE-2021-43798★ 0githubgithub.com/Okymi-X/CVE-2021-43798★ 0githubgithub.com/halencarjunior/grafana-CVE-2021-43798★ 0githubgithub.com/ticofookfook/CVE-2021-43798★ 0githubgithub.com/MalekAlthubiany/CVE-2021-43798★ 0githubgithub.com/gixxyboy/CVE-2021-43798★ 0githubgithub.com/hxlxmj/Grafxploit★ 0githubgithub.com/G01d3nW01f/CVE-2021-43798★ 0githubgithub.com/mauricelambert/LabAutomationCVE-2021-43798★ 0githubgithub.com/victorhorowitz/grafana-exploit-CVE-2021-43798★ 0githubgithub.com/JiuBanSec/Grafana-CVE-2021-43798★ 0githubgithub.com/davidrxchester/Grafana-8.3-Directory-Traversal★ 0githubgithub.com/ravi5hanka/CVE-2021-43798-Exploit-for-Windows-and-Linux★ 0githubgithub.com/suljov/Grafana-LFI-exploit★ 0githubgithub.com/abuyazeen/CVE-2021-43798-Grafana-path-traversal-tester★ 0githubgithub.com/0xf3d0rq/CVE-2021-43798★ 0githubgithub.com/baktistr/cve-2021-43798-enum★ 0githubgithub.com/notbside/CVE-2021-43798-PoC★ 0githubgithub.com/Shoxake17/CVE-2021-43798★ 0githubgithub.com/kikechans/-Grafana-LFI-CVE-2021-43798★ 0cve_referencepacketstormsecurity.com/files/165198/Grafana-Arbitrary-File-Reading.htmlunverifiedexploitdbwww.exploit-db.com/exploits/50581unverifiedcve_referencepacketstormsecurity.com/files/165221/Grafana-8.3.0-Directory-Traversal-Arbitrary-File-Read.htmlunverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
http://packetstormsecurity.com/files/165198/Grafana-Arbitrary-File-Reading.htmlhttp://packetstormsecurity.com/files/165221/Grafana-8.3.0-Directory-Traversal-Arbitrary-File-Read.htmlhttps://github.com/grafana/grafana/commit/c798c0e958d15d9cc7f27c72113d572fa58545cehttps://github.com/grafana/grafana/security/advisories/GHSA-8pjx-jj86-j47phttps://grafana.com/blog/2021/12/08/an-update-on-0day-cve-2021-43798-grafana-directory-traversal/https://security.netapp.com/advisory/ntap-20211229-0004/https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-43798http://www.openwall.com/lists/oss-security/2021/12/09/2http://www.openwall.com/lists/oss-security/2021/12/10/4