{"id":102584,"date":"2021-12-11T15:36:53","date_gmt":"2021-12-11T13:36:54","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-grafana-pozvolyayushhie-poluchit-dostup-k-fajlam-v-sisteme"},"modified":"2021-12-11T15:36:53","modified_gmt":"2021-12-11T13:36:54","slug":"uyazvimosti-v-grafana-pozvolyayushhie-poluchit-dostup-k-fajlam-v-sisteme","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimosti-v-grafana-pozvolyayushhie-poluchit-dostup-k-fajlam-v-sisteme","title":{"rendered":"Vulnerabilitete n\u00eb Grafana q\u00eb lejojn\u00eb qasje n\u00eb skedar\u00eb n\u00eb sistem","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

N\u00eb platform\u00ebn e hapur t\u00eb vizualizimit t\u00eb t\u00eb dh\u00ebnave Grafana \u00ebsht\u00eb identifikuar nj\u00eb dob\u00ebsi (CVE-2021-43798) e cila lejon kalimin p\u00ebrtej katalogut baz\u00eb dhe qasjen n\u00eb skedar\u00eb t\u00eb ndrysh\u00ebm n\u00eb sistemin lokal t\u00eb skedar\u00ebve t\u00eb serverit, n\u00eb p\u00ebrputhje me t\u00eb drejtat e aksesit t\u00eb p\u00ebrdoruesit n\u00ebn t\u00eb cilin funksionon Grafana. Problemi shkaktohet nga nj\u00eb funksionim i gabuar i trajtes\u00ebs s\u00eb rrug\u00ebs \"\\\/public\\\/plugins\\\/\\\/\" ku lejohej p\u00ebrdorimi i simboleve \"..\" p\u00ebr t\u00eb qasje n\u00eb katalog t\u00eb posht\u00ebm. <\/p>\n

Vulnerabiliteti mund t\u00eb shfryt\u00ebzohet p\u00ebrmes k\u00ebrkesave n\u00eb URL-t\u00eb e shtojcave standart t\u00eb instaluara, si\u00e7 jan\u00eb «\\\/public\\\/plugins\\\/graph\\\/», «\\\/public\\\/plugins\\\/mysql\\\/» dhe «\\\/public\\\/plugins\\\/prometheus\\\/» (n\u00eb total jan\u00eb instalur rreth 40 shtojca). P\u00ebr shembull, p\u00ebr t\u00eb aksesuar skedarin \\\/etc\\\/passwd, mund t\u00eb ishte d\u00ebrguar nj\u00eb k\u00ebrkes\u00eb si «\\\/public\\\/plugins\\\/prometheus\\\/..\\\/..\\\/..\\\/..\\\/..\\\/..\\\/..\\\/..\\\/etc\\\/passwd». P\u00ebr identifikimin e shenjave t\u00eb shfryt\u00ebzimit, rekomandohet t\u00eb kontrolloni pranin\u00eb e mask\u00ebs «..» n\u00eb loget e serverit http.

\"Vulnerabilitete<\/center> <\/p>\n

Problemi u shfaq fillimisht q\u00eb nga versioni 8.0.0-beta1 dhe u zgjidh n\u00eb l\u00ebshimet e Grafana 8.3.1, 8.2.7, 8.1.8 dhe 8.0.7, por m\u00eb pas u identifikuan edhe dy dob\u00ebsi t\u00eb ngjashme (CVE-2021-43813, CVE-2021-43815) t\u00eb cilat shfaqeshin q\u00eb nga versionet Grafana 5.0.0 dhe Grafana 8.0.0-beta3, duke lejuar nj\u00eb p\u00ebrdorues t\u00eb autentifikuar t\u00eb Grafana t\u00eb qaset n\u00eb skedare t\u00eb ndryshme n\u00eb sistemin, q\u00eb kan\u00eb shtesa \".md\" dhe \".csv\" (me emra skedar\u00ebsh vet\u00ebm n\u00eb shkronja t\u00eb vogla ose vet\u00ebm n\u00eb shkronja t\u00eb m\u00ebdha), p\u00ebrmes manipulimit me simbolet \"..\" n\u00eb rrug\u00ebt \"\\\/api\\\/plugins\\\/.*\\\/markdown\\\/.*\" dhe \"\\\/api\\\/ds\\\/query\". P\u00ebr zgjidhjen e k\u00ebtyre dob\u00ebsive jan\u00eb formuar p\u00ebrdit\u00ebsime p\u00ebr Grafana 8.3.2 dhe 7.5.12.
\n
Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 \u0432\u0438\u0437\u0443\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 Grafana \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-43798), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u0439\u0442\u0438 \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u044b \u0431\u0430\u0437\u043e\u0432\u043e\u0433\u043e \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430 \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u043c \u0444\u0430\u0439\u043b\u0430\u043c \u0432 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0444\u0430\u0439\u043b\u043e\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u0430, \u043d\u0430\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u044d\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u043f\u0440\u0430\u0432\u0430 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u043f\u043e\u0434 \u043a\u043e\u0442\u043e\u0440\u044b\u043c \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442\u0441\u044f Grafana. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u0439 \u0440\u0430\u0431\u043e\u0442\u043e\u0439 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430 \u043f\u0443\u0442\u0438 «\/public\/plugins\/<plugin-id>\/», \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u043b\u043e\u0441\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0438\u043c\u0432\u043e\u043b\u043e\u0432 «..» \u0434\u043b\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u043d\u0438\u0436\u0435\u043b\u0435\u0436\u0430\u0449\u0438\u043c \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430\u043c. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":102585,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-102584","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Dob\u00ebsit\u00eb n\u00eb Grafana, q\u00eb lejojn\u00eb aksesin n\u00eb skedar\u00ebt n\u00eb sistem | ProHoster","description":"N\u00eb platform\u00ebn e hapur t\u00eb vizualizimit t\u00eb t\u00eb dh\u00ebnave Grafana \u00ebsht\u00eb identifikuar nj\u00eb dob\u00ebsi (CVE-2021-43798), e cila lejon kalimin p\u00ebrtej katalogut t\u00eb baz\u00ebs dhe qasjen n\u00eb skedar\u00eb t\u00eb rast\u00ebsish\u00ebm n\u00eb sistemin lokal t\u00eb skedar\u00ebve t\u00eb serverit.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimosti-v-grafana-pozvolyayushhie-poluchit-dostup-k-fajlam-v-sisteme","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 Grafana, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0444\u0430\u0439\u043b\u0430\u043c \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 | ProHoster","og:description":"\u0412 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 \u0432\u0438\u0437\u0443\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 Grafana \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-43798), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u0439\u0442\u0438 \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u044b \u0431\u0430\u0437\u043e\u0432\u043e\u0433\u043e \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430 \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u043c \u0444\u0430\u0439\u043b\u0430\u043c \u0432 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0444\u0430\u0439\u043b\u043e\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u0430.","og:url":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimosti-v-grafana-pozvolyayushhie-poluchit-dostup-k-fajlam-v-sisteme","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-12-11T13:36:54+00:00","article:modified_time":"2021-12-11T13:36:54+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"102584","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-12-11 13:37:19","updated":"2022-09-27 18:20:09","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/102584","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=102584"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/102584\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/102585"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=102584"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=102584"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=102584"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}