袙 芯褌泻褉褘褌芯泄 锌谢邪褌褎芯褉屑械 胁懈蟹褍邪谢懈蟹邪褑懈懈 写邪薪薪褘褏 Grafana 胁褘褟胁谢械薪邪 褍褟蟹胁懈屑芯褋褌褜 (CVE-2021-43798), 锌芯蟹胁芯谢褟褞褖邪褟 胁褘泄褌懈 蟹邪 锌褉械写械谢褘 斜邪蟹芯胁芯谐芯 泻邪褌邪谢芯谐邪 懈 锌芯谢褍褔懈褌褜 写芯褋褌褍锌 泻 锌褉芯懈蟹胁芯谢褜薪褘屑 褎邪泄谢邪屑 胁 谢芯泻邪谢褜薪芯泄 褎邪泄谢芯胁芯泄 褋懈褋褌械屑械 褋械褉胁械褉邪, 薪邪褋泻芯谢褜泻芯 褝褌芯 锌芯蟹胁芯谢褟褞褌 锌褉邪胁邪 写芯褋褌褍锌邪 锌芯谢褜蟹芯胁邪褌械谢褟, 锌芯写 泻芯褌芯褉褘屑 胁褘锌芯谢薪褟械褌褋褟 Grafana. 袩褉芯斜谢械屑邪 胁褘蟹胁邪薪邪 薪械泻芯褉褉械泻褌薪芯泄 褉邪斜芯褌芯泄 芯斜褉邪斜芯褌褔懈泻邪 锌褍褌懈 芦/public/plugins/<plugin-id>/禄, 胁 泻芯褌芯褉芯屑 写芯锌褍褋泻邪谢芯褋褜 懈褋锌芯谢褜蟹芯胁邪薪懈械 褋懈屑胁芯谢芯胁 芦..禄 写谢褟 写芯褋褌褍锌邪 泻 薪懈卸械谢械卸邪褖懈屑 泻邪褌邪谢芯谐邪屑.
校褟蟹胁懈屑芯褋褌褜 屑芯卸械褌 斜褘褌褜 褝泻褋锌谢褍邪褌懈褉芯胁邪薪邪 褔械褉械蟹 芯斜褉邪褖械薪懈械 泻 URL 褌懈锌芯胁褘褏 锌褉械写褍褋褌邪薪芯胁谢械薪薪褘褏 锌谢邪谐懈薪芯胁, 褌邪泻懈褏 泻邪泻 芦/public/plugins/graph/禄, 芦/public/plugins/mysql/禄 懈 芦/public/plugins/prometheus/禄 (胁褋械谐芯 锌褉械写褍褋褌邪薪芯胁谢械薪芯 芯泻芯谢芯 40 锌谢邪谐懈薪芯胁). 袧邪锌褉懈屑械褉, 写谢褟 写芯褋褌褍锌邪 泻 褎邪泄谢褍 /etc/passwd 屑芯卸薪芯 斜褘谢芯 芯褌锌褉邪胁懈褌褜 蟹邪锌褉芯褋 芦/public/plugins/prometheus/../../../../../../../../etc/passwd禄. 袛谢褟 胁褘褟胁谢械薪懈褟 褋谢械写芯胁 褝泻褋锌谢褍褌邪褑懈懈 褉械泻芯屑械薪写褍械褌褋褟 锌褉芯胁械褉懈褌褜 薪邪谢懈褔懈械 屑邪褋泻懈 芦..%2f禄 胁 谢芯谐邪褏 http-褋械褉胁械褉邪.
袩褉芯斜谢械屑邪 锌褉芯褟胁谢褟谢邪褋褜 薪邪褔懈薪邪褟 褋 胁械褉褋懈懈 8.0.0-beta1 懈 褍褋褌褉邪薪械薪邪 胁 胁褘锌褍褋泻邪褏 Grafana 8.3.1, 8.2.7, 8.1.8 懈 8.0.7, 薪芯 褋谢械写芯屑 斜褘谢懈 胁褘褟胁谢械薪褘 械褖褢 写胁械 锌芯褏芯卸懈械 褍褟蟹胁懈屑芯褋褌懈 (CVE-2021-43813, CVE-2021-43815) 泻芯褌芯褉褘械 锌褉芯褟胁谢褟谢懈褋褜 薪邪褔懈薪邪褟 褋 胁械褉褋懈泄 Grafana 5.0.0 懈 Grafana 8.0.0-beta3, 懈 锌芯蟹胁芯谢褟谢懈 邪褍褌械薪褌懈褎懈褑懈褉芯胁邪薪薪芯屑褍 锌芯谢褜蟹芯胁邪褌械谢褞 Grafana 锌芯谢褍褔懈褌褜 写芯褋褌褍锌 泻 锌褉芯懈蟹胁芯谢褜薪褘屑 褎邪泄谢邪屑 胁 褋懈褋褌械屑械, 懈屑械褞褖懈屑 褉邪褋褕懈褉械薪懈褟 芦.md禄 懈 芦.csv禄 (褋 懈屑械薪邪屑懈 褎邪泄谢芯胁 褌芯谢褜泻芯 胁 薪懈卸薪械屑 懈谢懈 褌芯谢褜泻芯 胁 胁械褉褏薪械屑 褉械谐懈褋褌褉械), 褔械褉械蟹 屑邪薪懈锌褍谢褟褑懈褞 褋 褋懈屑胁芯谢邪屑懈 芦..禄 胁 锌褍褌褟褏 芦/api/plugins/.*/markdown/.*禄 懈 芦/api/ds/query禄. 袛谢褟 褍褋褌褉邪薪械薪懈褟 写邪薪薪褘褏 褍褟蟹胁懈屑芯褋褌械泄 褋褎芯褉屑懈褉芯胁邪薪褘 芯斜薪芯胁谢械薪懈褟 Grafana 8.3.2 懈 7.5.12.
诪拽讜专: opennet.ru