Share
## https://sploitus.com/exploit?id=1FA224FA-E468-5CDD-8F0F-8CB5524AAD10
# CVE-2021-43798 Grafana任意文件读取

## 1.installation

```shell
pip3 install -r requirements.txt
```

## 2.Usage

```shell
$ python3 grafana.py -h

   ____  __     __  _____           ____     ___    ____    _           _  _     _____   _____    ___     ___
  / ___| \ \   / / | ____|         |___ \   / _ \  |___ \  / |         | || |   |___ /  |___  |  / _ \   ( _ )
 | |      \ \ / /  |  _|    _____    __) | | | | |   __) | | |  _____  | || |_    |_ \     / /  | (_) |  / _ \
 | |___    \ V /   | |___  |_____|  / __/  | |_| |  / __/  | | |_____| |__   _|  ___) |   / /    \__, | | (_) |
  \____|    \_/    |_____|         |_____|  \___/  |_____| |_|            |_|   |____/   /_/       /_/   \___/


                                        CVE-2021-43798 Grafana任意文件读取
                                                                By:K3rwin
usage: grafana.py [-h] [-u U] [-r R]

命令行传入url参数,-u 指定单个地址,-r 从文件读取批量地址

optional arguments:
  -h, --help  show this help message and exit
  -u U        单个url地址,可尝试49个poc
  -r R        url文件列表,只使用默认poc
```

## 3.example

![image-20211217145217400](README.assets/image-20211217145217400.png)

![image-20211217145143609](README.assets/image-20211217145143609.png)