{"id":102584,"date":"2021-12-11T15:36:53","date_gmt":"2021-12-11T13:36:54","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-grafana-pozvolyayushhie-poluchit-dostup-k-fajlam-v-sisteme"},"modified":"2021-12-11T15:36:53","modified_gmt":"2021-12-11T13:36:54","slug":"uyazvimosti-v-grafana-pozvolyayushhie-poluchit-dostup-k-fajlam-v-sisteme","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimosti-v-grafana-pozvolyayushhie-poluchit-dostup-k-fajlam-v-sisteme","title":{"rendered":"Vulnerabilities in Grafana allow access to system files","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
A vulnerability has been identified in the open data visualization platform Grafana (CVE-2021-43798) that allows users to traverse the directory structure and access arbitrary files on the server's local file system, depending on the access rights of the user under which Grafana operates. The issue arises from improper handling of the path handler \"\/public\/plugins\/\/\" that permitted the use of the \"..\" character to access parent directories. <\/p>\n
The vulnerability can be exploited by accessing URLs for standard pre-installed plugins such as \"\/public\/plugins\/graph\/\", \"\/public\/plugins\/mysql\/\" and \"\/public\/plugins\/prometheus\/\" (approximately 40 plugins are pre-installed). For example, to access the file \/etc\/passwd, a request like \"\/public\/plugins\/prometheus\/..\/..\/..\/..\/..\/..\/etc\/passwd\" could be sent. To detect signs of exploitation, it is advisable to check for the presence of the mask \"..\" in the HTTP server logs.
<\/center> <\/p>\n
The issue was present starting from version 8.0.0-beta1 and was fixed in Grafana versions 8.3.1, 8.2.7, 8.1.8, and 8.0.7. However, two similar vulnerabilities (CVE-2021-43813, CVE-2021-43815) were subsequently discovered, which appeared in Grafana versions 5.0.0 and 8.0.0-beta3. These allowed authenticated Grafana users to access arbitrary files in the system with extensions \".md\" and \".csv\" (with filenames in either all lowercase or all uppercase) through manipulation of the \"..\" characters in the paths \"\/api\/plugins\/.*\\\/markdown\/.*\" and \"\/api\/ds\/query\". Updates Grafana 8.3.2 and 7.5.12 have been released to address these vulnerabilities. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
![\"Vulnerabilities](\"\/wp-content\/uploads\/2021\/12\/aa262408ed021b1c0b5a3725a215a401.jpg\")
<\/center> <\/p>\n