Grafana path traversal (CVE-2021-43798)

CVE-2021-43798 is an arbitrary file read vulnerability in Grafana (versions 8.0.0 to 8.3.0), exploitable without authentication. Grafana serves each plugin's static assets under /public/plugins/<plugin-id>/, but doesn't normalise the .. in the requested path, so you can escape the plugin directory and read any file the Grafana process can open.

The condition is using a plugin id that exists (the built-in ones work: alertlist, graph, table, text, dashlist...). From there you back up with ../ to the root:

curl --path-as-is \
  'http://<ip>:3000/public/plugins/alertlist/../../../../../../../../etc/passwd'

--path-as-is stops curl from collapsing the ../ before sending them. The most rewarding targets on a box running Grafana:

• /etc/grafana/grafana.ini: config with admin_user/admin_password and the secret_key.
• /var/lib/grafana/grafana.db: SQLite database with users, hashes and, above all, the datasources (connections to external databases, often with credentials).
• System files (/etc/passwd, SSH keys, etc.) depending on the process's permissions.

Why it's so useful. It doesn't give direct execution, but it usually chains: with the admin credentials you log into Grafana and query /api/datasources, which reveals the passwords of connected databases (MySQL, PostgreSQL...), opening the next pivot. It's a file read that in practice works as a door to credentials.

How to detect it. Grafana's access log shows unauthenticated requests to /public/plugins/<id>/ followed by unnormalized ../../ and known absolute paths (/etc/grafana/grafana.ini, /var/lib/grafana/grafana.db, /etc/passwd). Since a legitimate client never requests plugin resources with ../, its presence is the signature; one source reading several sensitive files or trying different plugin ids gives away the sweep, and any WAF flags the traversal. Reading grafana.ini/grafana.db followed by an admin login and a query to /api/datasources closes the chain.

Defence. Upgrade Grafana to 8.3.1 or later, don't expose port 3000 to the Internet, and rotate any secret that may have been read (secret_key, datasource passwords). It's a concrete case of the generic path traversal / LFI.