Grafana releases an emergency patch for a Zero-Day vulnerability

THREAT LEVEL: Amber.

For a detailed advisory, download the pdf file here.

A vulnerability in Chrome and Microsoft Edge (Chromium-based) exists as a result of a use-after-free

Grafana, a database analyzing, and monitoring tool used by major companies has been affected by a high severe zero-day vulnerability.

CVE-2021-43798 is a path traversal vulnerability that allows an attacker to traverse outside the Grafana folder and remotely access restricted files.

Grafana comes with some pre-installed plugins like graph, MySQL etc. The vulnerability affects the URL path of the plugins. So, all the Grafana instances are vulnerable. The vulnerable URL path is: <grafana_host_url>/public/plugins/<“plugin-id”> where <“plugin-id”> is the plugin ID for any installed plugin.

This vulnerability affects versions 8.0.0-beta1 through 8.3.0. and has been fixed in versions 8.3.1, 8.2.7, 8.1.8, and 8.0.7. An emergency patch has been released by Grafana Labs after exploits started circulating over Twitter and GitHub. Grafana has advised to update the affected systems as soon as possible. However, the organizations that cannot upgrade their systems can run a reverse proxy in front of Grafana that normalizes the PATH of the request which will eliminate this flaw.