CVE-2021-43813: Directory Traversal in Grafana
GitHub Security Labs notified us that there’s a limited directory traversal attack against Grafana 8.3.1 which allows access to '.md' files. During our internal follow-up investigation, we found an attack allowing access to .csv files. The vulnerable URL path is: '/api/plugins/./markdown/.'
Other sources
Grafana is an open-source platform for monitoring and observability. Grafana prior to versions 8.3.2 and 7.5.12 contains a directory traversal vulnerability for fully lowercase or fully uppercase .md files. The vulnerability is limited in scope, and only allows access to files with the extension .md to authenticated users only. Grafana Cloud instances have not been affected by the vulnerability. Users should upgrade to patched versions 8.3.2 or 7.5.12. For users who cannot upgrade, running a reverse proxy in front of Grafana that normalizes the PATH of the request will mitigate the vulnerability. The proxy will have to also be able to handle url encoded paths. Alternatively, for fully lowercase or fully uppercase .md files, users can block /api/plugins/./markdown/. without losing any functionality beyond inlined plugin help text.
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2021-43813?
CVE-2021-43813 is a directory traversal vulnerability in Grafana prior to versions 8.3.2 and 7.5.12.
How severe is CVE-2021-43813?
CVE-2021-43813 has a severity rating of 4.3 (medium).
Which software versions are affected by CVE-2021-43813?
Grafana versions 8.3.2 and 7.5.12, as well as versions earlier than 7.5.12 and between 7.5.12 and 8.3.2, are affected by CVE-2021-43813.
What is the remedy for CVE-2021-43813?
The remedy for CVE-2021-43813 is to upgrade to Grafana version 8.3.2 or 7.5.12, depending on the current version being used.
How can I learn more about CVE-2021-43813?
You can find more information about CVE-2021-43813 at the following references: [CVE-2021-43813 on CVE](https://www.cve.org/CVERecord?id=CVE-2021-43813), [CVE-2021-43813 on NVD](https://nvd.nist.gov/vuln/detail/CVE-2021-43813), [Grafana 8.3.2 and 7.5.12 Release Notes](https://grafana.com/blog/2021/12/10/grafana-8.3.2-and-7.5.12-released-with-moderate-severity-security-fix/), [Bugzilla Red Hat Bug Report](https://bugzilla.redhat.com/show_bug.cgi?id=2031228), [Red Hat Security Advisory](https://access.redhat.com/errata/RHSA-2022:6024).