# Grafana CVE Scan 21-43798 0.1
#### Scanner for Grafana Path Traversal Vulnerability found in CVE-2021-43798
Disclaimer: This is for Educational Purposes only!
[![License: GPL v3](https://img.shields.io/badge/License-GPL%20v3-blue.svg)](http://www.gnu.org/licenses/gpl-3.0)
## References for CVE:
[1 - NIST CVE Details ](https://nvd.nist.gov/vuln/detail/CVE-2021-43798)
[2 - Grafana Notes](https://grafana.com/blog/2021/12/07/grafana-8.3.1-8.2.7-8.1.8-and-8.0.7-released-with-high-severity-security-fix/)
All installations between v8.0.0-beta1 and v8.3.0 should be upgraded as soon as possible.
If you cannot upgrade, running a reverse proxy in front of Grafana that normalizes the PATH of the request will mitigate the vulnerability. For example, the normalize_path setting in envoy.
Thanks to our defense-in-depth approach, Grafana Cloud instances have not been affected by the vulnerability.
As always, we closely coordinated with all cloud providers licensed to offer Grafana Pro. They have received early notification under embargo and confirmed that their offerings are secure at the time of this announcement. In alphabetical order, this is applicable to Amazon Managed Grafana and Azure Managed Grafana.
$ grafana-CVE-2021-43798 [FLAGS] [OPTIONS]
-c, --check Just check for Vulnerability
--help Prints help information
-n, --nossl Use http:// instead https:// on URL
-V, --version Prints version information
-f, --file <file> File to be read on grafana server
-H, --host <Host IP or domain> Host IP or Domain and port e.g. 127.0.0.1:3000 to be checked for CVE
-h, --hostlist <hostlist> File containing a list of Hosts 1 per line with ip/domain:port e.g. 127.0.0.1:3000
First you must install Rust package on your GNU/Linux distribution, MacOS ($$$$) or Windows (blergh!)
It is really easy to compile. Just run :
$ cargo build --release
Then you'll have the release ready in your <repo_downloaded_dir>/target/release/
That's all folks! Thank you very much.