This is a proof-of-concept exploit for Grafana's Unauthorized Arbitrary File Read Vulnerability (CVE-2021-43798).

Pedro Havay

Last update: Nov 18, 2022

Related tags

Security related resources exploit-grafana-CVE-2021-43798

Overview

CVE-2021-43798 – Grafana Exploit

About

This is a proof-of-concept exploit for Grafana's Unauthorized Arbitrary File Read Vulnerability (CVE-2021-43798).

This vulnerability affects Grafana 8.0.0-beta1 to 8.3.0.

According to Shodan data, there are just over 2,000 Grafana servers exposed online, with the majority residing in the US and Europe, as can be seen in the figure below.

For more information:

https://grafana.com/blog/2021/12/07/grafana-8.3.1-8.2.7-8.1.8-and-8.0.7-released-with-high-severity-security-fix/

Contributors

@pedrohavay and @acassio22

Disclaimer

This project is created only for educational purposes and cannot be used for law violation or personal gain.

The author of this project is not responsible for any possible harm caused by the materials of this project.

Demo

Installation

git clone https://github.com/pedrohavay/exploit-grafana-CVE-2021-43798
cd exploit-grafana-CVE-2021-43798
pip install -r requirements.txt

Usage

Collect all Grafana URLs in a single file. For example: targets.txt
Use the script
```
 python3 exploit.py
```

Requirements

Python 3
SQLite3

You might also like...

the metasploit script(POC/EXP) about CVE-2021-22005 VMware vCenter Server contains an arbitrary file upload vulnerability

CVE-2021-22005-metasploit the metasploit script(POC/EXP) about CVE-2021-22005 VMware vCenter Server contains an arbitrary file upload vulnerability pr

25 Nov 15, 2022

This repo contain builders of cab file, html file, and docx file for CVE-2021-40444 exploit

CVE-2021-40444 builders This repo contain builders of cab file, html file, and docx file for CVE-2021-40444 exploit. This repo is just for testing, re

168 Nov 9, 2022

Proof of concept for CVE-2021-24086, a NULL dereference in tcpip.sys triggered remotely.

CVE-2021-24086 This is a proof of concept for CVE-2021-24086 ("Windows TCP/IP Denial of Service Vulnerability "), a NULL dereference in tcpip.sys patc

220 Dec 14, 2022

Proof of concept to check if hosts are vulnerable to CVE-2021-41773

CVE-2021-41773 PoC Proof of concept to check if hosts are vulnerable to CVE-2021-41773. Description (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CV

43 Nov 9, 2022

Proof of concept for CVE-2021-31166, a remote HTTP.sys use-after-free triggered remotely.

CVE-2021-31166: HTTP Protocol Stack Remote Code Execution Vulnerability This is a proof of concept for CVE-2021-31166 ("HTTP Protocol Stack Remote Cod

820 Dec 18, 2022

Log4Shell Proof of Concept (CVE-2021-44228)

CVE-2021-44228 Log4Shell Proof of Concept (CVE-2021-44228) Make sure to use Java 8 JDK. Java 8 Download Images Credits Casey Dunham - Java Reverse She

3 Jul 23, 2022

A scanner and a proof of sample exploit for log4j RCE CVE-2021-44228

1.Create a Sample Vulnerable Application . 2.Start a netcat listner . 3.Run the exploit . 5.Use jdk1.8.0_20 for better results . Exploit-db - https://

7 Aug 6, 2022

command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation, attacker can exploit the vulnerability to launch a command injection attack by sending some messages with malicious commands.

CVE-2021-36260 CVE-2021-36260 POC command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validatio

165 Dec 21, 2022

log4j2 dos exploit,CVE-2021-45105 exploit,Denial of Service poc

说明 about author: 我超怕的 blog: https://www.cnblogs.com/iAmSoScArEd/ github: https://github.com/iAmSOScArEd/ date: 2021-12-20 log4j2 dos exploit log4j2 do

3 Aug 13, 2022

Comments

Mapping class not found

Traceback (most recent call last): File "", line 1, in ImportError: cannot import name 'Mapping' from 'collections' (/usr/lib/python3.10/collections/init.py)

opened by KnownBlackHat 0

This is a proof-of-concept exploit for Grafana's Unauthorized Arbitrary File Read Vulnerability (CVE-2021-43798).

Related tags

Overview

CVE-2021-43798 – Grafana Exploit

About

Contributors

Disclaimer

Demo

Installation

Usage

Requirements

You might also like...

the metasploit script(POC/EXP) about CVE-2021-22005 VMware vCenter Server contains an arbitrary file upload vulnerability

This repo contain builders of cab file, html file, and docx file for CVE-2021-40444 exploit

Proof of concept for CVE-2021-24086, a NULL dereference in tcpip.sys triggered remotely.

Proof of concept to check if hosts are vulnerable to CVE-2021-41773

Proof of concept for CVE-2021-31166, a remote HTTP.sys use-after-free triggered remotely.

Log4Shell Proof of Concept (CVE-2021-44228)

A scanner and a proof of sample exploit for log4j RCE CVE-2021-44228

command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation, attacker can exploit the vulnerability to launch a command injection attack by sending some messages with malicious commands.

log4j2 dos exploit,CVE-2021-45105 exploit,Denial of Service poc

Comments

Mapping class not found

Owner

Pedro Havay

ProxyLogon Full Exploit Chain PoC (CVE-2021–26855, CVE-2021–26857, CVE-2021–26858, CVE-2021–27065)

Exploit tool for Adminer 1.0 up to 4.6.2 Arbitrary File Read vulnerability

VMware vCenter earlier v(7.0.2.00100) unauthorized arbitrary file read

A Proof-Of-Concept for the recently found CVE-2021-44228 vulnerability

Proof of Concept Exploit for vCenter CVE-2021-21972

Proof on Concept Exploit for CVE-2021-38647 (OMIGOD)

Proof of Concept Exploit for ManageEngine ServiceDesk Plus CVE-2021-44077

A proof-of-concept exploit for Log4j RCE Unauthenticated (CVE-2021-44228)

AnonStress-Stored-XSS-Exploit - An exploit and demonstration on how to exploit a Stored XSS vulnerability in anonstress

Grafana-POC(CVE-2021-43798)