Grafana Web Path Traversal Exploitation (CVE-2021-43798) With 200 Responses

title: Grafana Web Path Traversal Exploitation (CVE-2021-43798) With 200 Responses
id: 2eb70f0b-4679-4d52-89ee-4e6a436f4c42
status: test
description: This rule identifies Grafana web requests where the URL query contains a deep traversal sequence ('/../../../../../../../') and the HTTP response status is 200. It matters because successful path traversal can allow an attacker to reach unintended server paths, often enabling unauthorized access or further exploitation. The detection relies on webserver HTTP telemetry, specifically the request URI query string and the resulting status code.
references:
  - https://grafana.com/blog/2021/12/07/grafana-8.3.1-8.2.7-8.1.8-and-8.0.7-released-with-high-severity-security-fix/
  - https://github.com/search?q=CVE-2021-43798
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-43798/web_cve_2021_43798_grafana.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-12-08
modified: 2023-01-02
tags:
  - attack.initial-access
  - attack.t1190
  - cve.2021-43798
  - detection.emerging-threats
logsource:
  category: webserver
detection:
  selection_traversal:
    cs-uri-query|contains: /../../../../../../../
    sc-status: 200
  selection_plugins:
    cs-uri-query|contains:
      - /public/plugins/live
      - /public/plugins/icon
      - /public/plugins/loki
      - /public/plugins/text
      - /public/plugins/logs
      - /public/plugins/news
      - /public/plugins/stat
      - /public/plugins/mssql
      - /public/plugins/mixed
      - /public/plugins/mysql
      - /public/plugins/tempo
      - /public/plugins/graph
      - /public/plugins/gauge
      - /public/plugins/table
      - /public/plugins/debug
      - /public/plugins/zipkin
      - /public/plugins/jaeger
      - /public/plugins/geomap
      - /public/plugins/canvas
      - /public/plugins/grafana
      - /public/plugins/welcome
      - /public/plugins/xychart
      - /public/plugins/heatmap
      - /public/plugins/postgres
      - /public/plugins/testdata
      - /public/plugins/opentsdb
      - /public/plugins/influxdb
      - /public/plugins/barchart
      - /public/plugins/annolist
      - /public/plugins/bargauge
      - /public/plugins/graphite
      - /public/plugins/dashlist
      - /public/plugins/piechart
      - /public/plugins/dashboard
      - /public/plugins/nodeGraph
      - /public/plugins/alertlist
      - /public/plugins/histogram
      - /public/plugins/table-old
      - /public/plugins/pluginlist
      - /public/plugins/timeseries
      - /public/plugins/cloudwatch
      - /public/plugins/prometheus
      - /public/plugins/stackdriver
      - /public/plugins/alertGroups
      - /public/plugins/alertmanager
      - /public/plugins/elasticsearch
      - /public/plugins/gettingstarted
      - /public/plugins/state-timeline
      - /public/plugins/status-history
      - /public/plugins/grafana-clock-panel
      - /public/plugins/grafana-simple-json-datasource
      - /public/plugins/grafana-azure-monitor-datasource
  condition: all of selection*
falsepositives:
  - Vulnerability scanners that scan a host that returns 200 status codes even in cases of a file not found or other error
level: critical
license: DRL-1.1
related:
  - id: 7b72b328-5708-414f-9a2a-6a6867c26e16
    type: derived