Miggo Logo
Miggo Vulnerability Database
→
CVE-2021-43798

CVE-2021-43798: Grafana path traversal

7.5

CVSS Score
3.1

Basic Information

CVE ID
CVE-2021-43798
GHSA ID
GHSA-8pjx-jj86-j47p
EPSS Score
0.99943%
CWE
CWE-22
Published
2/1/2024
Updated
2/1/2024
KEV Status
No
Technology
TechnologyGo

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
github.com/grafana/grafanago>= 8.3.0, < 8.3.18.3.1
github.com/grafana/grafanago>= 8.2.0, < 8.2.78.2.7
github.com/grafana/grafanago>= 8.1.0, < 8.1.88.1.8
github.com/grafana/grafanago>= 8.0.0-beta1, < 8.0.78.0.7

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from improper path handling in the plugin asset serving endpoint. Analysis of the security patch (commit c798c0e) shows the fix involved: 1) Adding path normalization with filepath.Rel() after prepending a slash, 2) Using absolute paths for plugin directories, and 3) Strict path containment checks. The original implementation in getPluginAssets concatenated user-controlled path parameters directly with plugin directories without sufficient validation, making it vulnerable to ../ style traversal attacks. The function's role in handling /public/plugins/ routes matches the vulnerability description's attack vector.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

To**y w* *r* r*l**sin* *r***n* *.*.*, *.*.*, *.*.*, *.*.*. T*is p*t** r*l**s* in*lu**s * *i** s*v*rity s**urity *ix t**t *****ts *r***n* v*rsions *rom v*.*.*-**t** t*rou** v*.*.*. R*l**s* v*.*.*, only *ont*inin* * s**urity *ix: - [*ownlo** *r***n*

Reasoning

T** vuln*r**ility st*ms *rom improp*r p*t* **n*lin* in t** plu*in *ss*t s*rvin* *n*point. *n*lysis o* t** s**urity p*t** (*ommit *******) s*ows t** *ix involv**: *) ***in* p*t* norm*liz*tion wit* `*il*p*t*.R*l()` **t*r pr*p*n*in* * sl*s*, *) Usin* **