Grafana Webserver Path Traversal Exploitation (CVE-2021-43798) via URI Query

title: Grafana Webserver Path Traversal Exploitation (CVE-2021-43798) via URI Query
id: 2eb70f0b-4679-4d52-89ee-4e6a436f4c42
status: test
description: This rule flags successful Grafana path traversal attempts by matching HTTP requests where the URI query contains a deep traversal sequence ('/../../../../../../../') and the server response status is 200. It focuses on exploitation outcomes rather than failed requests, which is important because attackers may successfully reach unintended paths after traversal. The detection relies on webserver HTTP request telemetry fields for the URI query content and the response status code.
references:
  - https://grafana.com/blog/2021/12/07/grafana-8.3.1-8.2.7-8.1.8-and-8.0.7-released-with-high-severity-security-fix/
  - https://github.com/search?q=CVE-2021-43798
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-43798/web_cve_2021_43798_grafana.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-12-08
modified: 2023-01-02
tags:
  - attack.initial-access
  - attack.t1190
  - cve.2021-43798
  - detection.emerging-threats
logsource:
  category: webserver
detection:
  selection_traversal:
    cs-uri-query|contains: /../../../../../../../
    sc-status: 200
  selection_plugins:
    cs-uri-query|contains:
      - /public/plugins/live
      - /public/plugins/icon
      - /public/plugins/loki
      - /public/plugins/text
      - /public/plugins/logs
      - /public/plugins/news
      - /public/plugins/stat
      - /public/plugins/mssql
      - /public/plugins/mixed
      - /public/plugins/mysql
      - /public/plugins/tempo
      - /public/plugins/graph
      - /public/plugins/gauge
      - /public/plugins/table
      - /public/plugins/debug
      - /public/plugins/zipkin
      - /public/plugins/jaeger
      - /public/plugins/geomap
      - /public/plugins/canvas
      - /public/plugins/grafana
      - /public/plugins/welcome
      - /public/plugins/xychart
      - /public/plugins/heatmap
      - /public/plugins/postgres
      - /public/plugins/testdata
      - /public/plugins/opentsdb
      - /public/plugins/influxdb
      - /public/plugins/barchart
      - /public/plugins/annolist
      - /public/plugins/bargauge
      - /public/plugins/graphite
      - /public/plugins/dashlist
      - /public/plugins/piechart
      - /public/plugins/dashboard
      - /public/plugins/nodeGraph
      - /public/plugins/alertlist
      - /public/plugins/histogram
      - /public/plugins/table-old
      - /public/plugins/pluginlist
      - /public/plugins/timeseries
      - /public/plugins/cloudwatch
      - /public/plugins/prometheus
      - /public/plugins/stackdriver
      - /public/plugins/alertGroups
      - /public/plugins/alertmanager
      - /public/plugins/elasticsearch
      - /public/plugins/gettingstarted
      - /public/plugins/state-timeline
      - /public/plugins/status-history
      - /public/plugins/grafana-clock-panel
      - /public/plugins/grafana-simple-json-datasource
      - /public/plugins/grafana-azure-monitor-datasource
  condition: all of selection*
falsepositives:
  - Vulnerability scanners that scan a host that returns 200 status codes even in cases of a file not found or other error
level: critical
license: DRL-1.1
related:
  - id: 7b72b328-5708-414f-9a2a-6a6867c26e16
    type: derived