grafanaExp

grafanaExp A exploit tool for Grafana Unauthorized arbitrary file reading vulnerability CVE-2021-43798, it can burst plugins / extract secretkey / decode datasource info automatic. Usage Automatic exploit with exp and local decode dbfile with decode. ➜ ./grafanaExp -h NAME: grafanaExp - Exploit...

Grafana_POC-CVE-2021-43798

Grafana-Poc Do not use this tool for illegal purposes. 1. Usage: python3 grafanahole.py Fill in ip:port in domain.txt 2. Vulnerability Impact Scope Affected versions: Grafana 8.0.0 - 8.3.0 Safe versions: Grafana 8.3.1, 8.2.7, 8.1.8, 8.0.7...

GrafXploit

Automated Exploit Tool for Grafana CVE-2021-43798 Overview This project is an automated exploit tool designed to scan for and extract sensitive information from compromised Grafana instances vulnerable to CVE-2021-43798. The tool identifies vulnerable plugins and extracts SSH keys from compromise...

CVE-2021-43798

CVE-2021-43798 Grafana - Directory Traversal and Arbitrary File Read https://vulners.com/cve/CVE-2021-43798 https://grafana.com/blog/2021/12/08/an-update-on-0day-cve-2021-43798-grafana-directory-traversal/ Example python3 exploit.py http://127.0.0.1:3000 /etc/passwd python3 exploit.py...

CVE-2026-72585-PoC

CVE-2026-72585 — Grafana: Incomplete Fix for CVE-2026-21724 Allows Editor Role to Delete Protected Contact Points Product: Grafana Grafana Labs — through 13.2.0 File: pkg/services/ngalert/provisioning/contactpoints.go CWE: CWE-284 — Improper Access Control CVSS 3.1:...

GrafanaDirInclusion

Grafana CVE-2021-43798 Exploit Script Script to demonstrate the Grafana directory traversal exploit CVE-2021-43798 that affects Grafana versions 8.0.0-beta1 through 8.3.0. Primarily used for a demonstration in a CTF. Written in python with standard library modules only. Only use this for legitima...

CVE-2021-43798-mass_scanner

Grafana CVE 2021-43798 Grafana Unauthorized arbitrary file reading vulnerability CVE-2021-43798 deps python3 -m pip install -r requirements.txt or pipenv install -r requirements.txt Dorks Dorks Shodan | Google Google Dorks Shodan Dorks Usage Targets without / at the end. And without http:// or...

Cowrie and Grafana Honeypot using Terraform on DigitalOcean

Cowrie & Grafana Honeypot using Terraform on DigitalOcean Demo Video Table of Contents System Overview Technologies Project Directory Structure Hardware Requirements Installation & Setup Terraform State Management CI/CD Pipeline System Architecture Observations Runtime Metrics Usage Project...

CVE-2021-43798-Grafana-File-Read

Grafana-File-Read Grafana Unauthorized File Read Affected versions: 8.0.0-latest poc: /public/plugins/icon/../../../../../../../../../../../../../../../../../../etc/passwd GET /public/plugins/icon/../../../../../../../../../../../../../../../../../../etc/passwd HTTP/1.1 Host: 127.0.0.1:3000...

CVE-2024-9264-in-Grafana-11.x

This repository does not have a README...

exploit-grafana-CVE-2021-43798

CVE-2021-43798 – Grafana Exploit About This is a proof-of-concept exploit for Grafana's Unauthorized Arbitrary File Read Vulnerability CVE-2021-43798. This vulnerability affects Grafana 8.0.0-beta1 to 8.3.0. According to Shodan data, there are just over 2,000 Grafana servers exposed online, with...

grafana-cve-2021-43798

grafana-cve-2021-43798 This repository contains files for reproducing the vulnerability. Deploy this in your cluster using this command. kubectl apply -f grafana-vuln-app.yaml...

day05-grafana-sqlexpr-lab

Day 5 – Grafana SQL Expressions → DuckDB LFI CVE-2024-9264 TL;DR: On affected Grafana 11.x builds, a logged-in Viewer can use SQL Expressions. Grafana forwards the expression to DuckDB on the server. With readtext / readblob, you can read local files LFI. We plant a flag at /opt/flag.txt. Build →...

grafanaExp

grafanaExp Exploit Grafana CVE-2021-43798 arbitrary file read vulnerability to automatically detect vulnerability, existing plugins, extract secret key, decrypt server database file, and output datasourrce info. Usage Provides exp and decode functionality. ➜ ./grafanaExp -h NAME: grafanaExp -...

grafana-signup-invite-join

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · grafana-signup-invite-join Write-up: https://abraxaslabs.tech/research/grafana-signup-invite-join grafana-signup-invite-join Class: Privilege leftover Reach: Remote Grafana OSS 13.2.3 6193dc0 - Grafana Labs When...

Grafana-Final-Scanner

Grafana Final Scanner A command-line vulnerability scanner for Grafana. It fingerprints the installed Grafana version, runs a set of version-aware CVE checks, audits common configuration weaknesses, stores results in a local database, and can serve them through a small web dashboard. Legal This...

CVE-2021-43798

CVE-2021-43798: Grafana Arbitrary File Read Vulnerability Added nuclei template for full-version detection on Windows+Linux List of 52 plugins: live icon loki text logs news stat mssql mixed mysql tempo graph gauge table debug zipkin jaeger geomap canvas grafana welcome xychart heatmap postgres...

Grafana-CVE-2021-43798

Grafana-CVE-2021-43798 Grafana File-Read Affected versions: 8.0.0-lastest Poc-http-get /public/plugins/plugins-lst/../../../../../../../../filename Default plugins list alertlist annolist grafana-azure-monitor-datasource barchart bargauge cloudwatch dashlist elasticsearch gauge geomap...

grafana-CVE-2018-15727

Grafana CVE-2018-15727 exploit Installation $ go get github.com/u238/grafana-CVE-2018-15727 Usage $ source go env $ $GOPATH/bin/grafana-CVE-2018-15727 ldapadmin i delete the grafanasess cookie from your browser session i set following cookies in you browser: for Grafana 5.x: grafanauser : ldapadm...

CVE-2021-43798

GrafanaArbitraryFileRead Usage 1. show info ❯ go run main.go -s INF VulnInfo: "Name": "Grafana Arbitrary File Read", "VulID": "nil", "Version": "1.0", "Author": "z3", "VulDate": "2021-12-07", "References": "https://nosec.org/home/detail/4914.html" , "AppName": "Grafana", "AppPowerLink":...