{"id":102584,"date":"2021-12-11T15:36:53","date_gmt":"2021-12-11T13:36:54","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-grafana-pozvolyayushhie-poluchit-dostup-k-fajlam-v-sisteme"},"modified":"2021-12-11T15:36:53","modified_gmt":"2021-12-11T13:36:54","slug":"uyazvimosti-v-grafana-pozvolyayushhie-poluchit-dostup-k-fajlam-v-sisteme","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimosti-v-grafana-pozvolyayushhie-poluchit-dostup-k-fajlam-v-sisteme","title":{"rendered":"Vulnerabilitete n\u00eb Grafana q\u00eb lejojn\u00eb qasje n\u00eb skedar\u00eb n\u00eb sistem","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

N\u00eb platform\u00ebn e hapur t\u00eb vizualizimit t\u00eb t\u00eb dh\u00ebnave Grafana \u00ebsht\u00eb identifikuar nj\u00eb dob\u00ebsi (CVE-2021-43798) e cila lejon kalimin p\u00ebrtej katalogut baz\u00eb dhe qasjen n\u00eb skedar\u00eb t\u00eb ndrysh\u00ebm n\u00eb sistemin lokal t\u00eb skedar\u00ebve t\u00eb serverit, n\u00eb p\u00ebrputhje me t\u00eb drejtat e aksesit t\u00eb p\u00ebrdoruesit n\u00ebn t\u00eb cilin funksionon Grafana. Problemi shkaktohet nga nj\u00eb funksionim i gabuar i trajtes\u00ebs s\u00eb rrug\u00ebs \"\\\/public\\\/plugins\\\/\\\/\" ku lejohej p\u00ebrdorimi i simboleve \"..\" p\u00ebr t\u00eb qasje n\u00eb katalog t\u00eb posht\u00ebm. <\/p>\n

Vulnerabiliteti mund t\u00eb shfryt\u00ebzohet p\u00ebrmes qasjes n\u00eb URL-n\u00eb e parainstaluar t\u00eb plugin\u00ebve standard\u00eb, si «\\\/public\\\/plugins\\\/graph\\\/», «\\\/public\\\/plugins\\\/mysql\\\/» dhe «\\\/public\\\/plugins\\\/prometheus\\\/» (n\u00eb total jan\u00eb rreth 40 plugin\u00eb t\u00eb parainstaluar). P\u00ebr shembull, p\u00ebr t\u00eb aksesuar skedarin \\\/etc\\\/passwd, mund t\u00eb d\u00ebrgohej nj\u00eb k\u00ebrkes\u00eb «\\\/public\\\/plugins\\\/prometheus\\\/..\\\/..\\\/..\\\/..\\\/..\\\/..\\\/..\\\/..\\\/etc\\\/passwd». P\u00ebr t\u00eb identifikuar gjurm\u00ebt e shfryt\u00ebzimit, rekomandohet t\u00eb kontrolloni prani t\u00eb mask\u00ebs «..» n\u00eb logjet e serverit http.

\"Vulnerabilitete<\/center> <\/p>\n

Problemi u shfaq fillimisht q\u00eb nga versioni 8.0.0-beta1 dhe u zgjidh n\u00eb l\u00ebshimet e Grafana 8.3.1, 8.2.7, 8.1.8 dhe 8.0.7, por m\u00eb pas u identifikuan edhe dy dob\u00ebsi t\u00eb ngjashme (CVE-2021-43813, CVE-2021-43815) t\u00eb cilat shfaqeshin q\u00eb nga versionet Grafana 5.0.0 dhe Grafana 8.0.0-beta3, duke lejuar nj\u00eb p\u00ebrdorues t\u00eb autentifikuar t\u00eb Grafana t\u00eb qaset n\u00eb skedare t\u00eb ndryshme n\u00eb sistemin, q\u00eb kan\u00eb shtesa \".md\" dhe \".csv\" (me emra skedar\u00ebsh vet\u00ebm n\u00eb shkronja t\u00eb vogla ose vet\u00ebm n\u00eb shkronja t\u00eb m\u00ebdha), p\u00ebrmes manipulimit me simbolet \"..\" n\u00eb rrug\u00ebt \"\\\/api\\\/plugins\\\/.*\\\/markdown\\\/.*\" dhe \"\\\/api\\\/ds\\\/query\". P\u00ebr zgjidhjen e k\u00ebtyre dob\u00ebsive jan\u00eb formuar p\u00ebrdit\u00ebsime p\u00ebr Grafana 8.3.2 dhe 7.5.12.
\n
Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 \u0432\u0438\u0437\u0443\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 Grafana \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-43798), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u0439\u0442\u0438 \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u044b \u0431\u0430\u0437\u043e\u0432\u043e\u0433\u043e \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430 \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u043c \u0444\u0430\u0439\u043b\u0430\u043c \u0432 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0444\u0430\u0439\u043b\u043e\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u0430, \u043d\u0430\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u044d\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u043f\u0440\u0430\u0432\u0430 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u043f\u043e\u0434 \u043a\u043e\u0442\u043e\u0440\u044b\u043c \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442\u0441\u044f Grafana. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u0439 \u0440\u0430\u0431\u043e\u0442\u043e\u0439 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430 \u043f\u0443\u0442\u0438 «\/public\/plugins\/<plugin-id>\/», \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u043b\u043e\u0441\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0438\u043c\u0432\u043e\u043b\u043e\u0432 «..» \u0434\u043b\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u043d\u0438\u0436\u0435\u043b\u0435\u0436\u0430\u0449\u0438\u043c \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430\u043c. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":102585,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-102584","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Dob\u00ebsit\u00eb n\u00eb Grafana, q\u00eb lejojn\u00eb aksesin n\u00eb skedar\u00ebt n\u00eb sistem | ProHoster","description":"N\u00eb platform\u00ebn e hapur t\u00eb vizualizimit t\u00eb t\u00eb dh\u00ebnave Grafana \u00ebsht\u00eb identifikuar nj\u00eb dob\u00ebsi (CVE-2021-43798), e cila lejon kalimin p\u00ebrtej katalogut t\u00eb baz\u00ebs dhe qasjen n\u00eb skedar\u00eb t\u00eb rast\u00ebsish\u00ebm n\u00eb sistemin lokal t\u00eb skedar\u00ebve t\u00eb serverit.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimosti-v-grafana-pozvolyayushhie-poluchit-dostup-k-fajlam-v-sisteme","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Grafana, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0444\u0430\u0439\u043b\u0430\u043c \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 | ProHoster","og:description":"\u0412 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 \u0432\u0438\u0437\u0443\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 Grafana \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-43798), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u0439\u0442\u0438 \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u044b \u0431\u0430\u0437\u043e\u0432\u043e\u0433\u043e \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430 \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u043c \u0444\u0430\u0439\u043b\u0430\u043c \u0432 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0444\u0430\u0439\u043b\u043e\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u0430.","og:url":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimosti-v-grafana-pozvolyayushhie-poluchit-dostup-k-fajlam-v-sisteme","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-12-11T13:36:54+00:00","article:modified_time":"2021-12-11T13:36:54+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"102584","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-12-11 13:37:19","updated":"2022-09-27 18:20:09","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/102584","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=102584"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/102584\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/102585"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=102584"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=102584"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=102584"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}