CVE-2021-43813 Directory Traversal in Grafana
Authenticated attackers can read arbitrary markdown files via directory traversal in Grafana, requiring an upgrade to patched versions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-43813?
CVE-2021-43813 is a medium-severity path traversal vulnerability in Grafana Grafana, published on 10 Dec 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Grafana is an open-source platform for monitoring and observability. Grafana prior to versions 8.3.2 and 7.5.12 contains a directory traversal vulnerability for fully lowercase or fully uppercase .md files. The vulnerability is limited in scope, and only allows access to files with the extension .md to authenticated users only. Grafana Cloud instances have not been affected by the vulnerability. Users should upgrade to patched versions 8.3.2 or 7.5.12. For users who cannot upgrade, running a reverse proxy in front of Grafana that normalizes the PATH of the request will mitigate the vulnerability. The proxy will have to also be able to handle url encoded paths. Alternatively, for fully lowercase or fully uppercase .md files, users can block /api/plugins/.*/markdown/.* without losing any functionality beyond inlined plugin help text.
Weakness: CWE-22
Which versions are affected by CVE-2021-43813?
1 open source package ship an affected version, including grafana. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
grafana Bitnami | From 5.0.0 | 7.5.12, 8.3.2 |
Linux distribution packages (5)
grafana AlmaLinux:8 | All versions | 7.5.11-2.el8 |
grafana Red Hat:enterprise_linux:8::appstream | All versions | 0:7.5.11-2.el8 |
grafana-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:7.5.11-2.el8 |
grafana Rocky Linux:8 | All versions | 0:7.5.11-2.el8 |
grafana openSUSE:Tumbleweed | All versions | 7.5.12-1.1 |
Products include Grafana Grafana.
How do I fix CVE-2021-43813?
Upgrade grafana to a fixed version for your release line: 7.5.12 or 8.3.2.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2021-43813 being exploited?
There is no known exploitation of CVE-2021-43813 in the wild and no public exploit code.
Other vulnerabilities in Grafana Grafana
Sources
Also known as ALSA-2022:1781, BIT-grafana-2021-43813, GHSA-c3q8-26ph-9g2q, OESA-2021-1470, RHSA-2022:1781, RLSA-2022:1781 and 2 more.