Summary
CVE-2021-43798 is a directory traversal vulnerability in Grafana 8.x that permits an unauthenticated, network-reachable attacker to read arbitrary files on the server. The flaw resides in the public route that serves plugin static resources, which concatenates user-supplied path input with a plugin’s base directory without normalization or containment checking. By embedding ../ traversal sequences in requests to the plugin resource endpoint, an attacker can escape the intended directory and retrieve any file readable by the Grafana process — which by default runs as the grafana user. Files such as /etc/passwd, the Grafana configuration file, and process environment variables may be exposed, potentially leaking credentials, database connection strings, or secret keys. The issue was resolved in Grafana 8.3.1 and backported to the 8.0.7, 8.1.8, and 8.2.7 releases.
Root cause
Grafana exposes an unauthenticated route for serving static assets belonging to installed plugins. When a request arrives, the handler takes the file-path segment from the URL and concatenates it with the plugin’s on-disk static-resource directory to produce the final path. Critically, no normalization, sanitization, or bounds check is applied before the resolved path is passed to the file-serving logic.
Because the user-supplied component is used verbatim, ../ sequences within it are interpreted relative to the plugin base directory and can traverse upward to arbitrary filesystem locations. The route parameters are not validated to confirm that the resolved path remains confined to the plugin directory before the file is read and returned.
The fix — commit c798c0e958d15d9cc7f27c72113d572fa58545ce — sanitizes the requested file path so that traversal sequences cannot escape the plugin base directory. It shipped in Grafana 8.3.1 and was backported to the 8.0.7, 8.1.8, and 8.2.7 patch releases.
Attack path and prerequisites
The vulnerability requires no authentication; any party that can reach the Grafana HTTP port on an affected version can exploit it. The attack leverages any installed plugin whose identifier is known or guessable — default built-in Grafana 8.x plugins are sufficient, so no special plugin installation or configuration is needed.
Conceptually, the attacker issues a request to the plugin static-resource route with path traversal sequences appended after a valid plugin ID. To ensure the traversal sequences survive transport to the server, the request must suppress client-side path normalization — for example, by using URL-encoded path separators or an HTTP client option that preserves the raw request path. On a vulnerable version, the server responds with HTTP 200 and the contents of the requested file; on a fixed version, the same request returns HTTP 404.
Exploitability is bounded by the read permissions of the Grafana process. The available information confirms that the process runs as the grafana user by default, but does not characterize what additional files or privileges may be accessible beyond that baseline on any given deployment.
Affected scope
The following Grafana version ranges are affected:
- 8.0.0-beta1 through 8.0.6 (fixed in 8.0.7)
- 8.1.0 through 8.1.7 (fixed in 8.1.8)
- 8.2.0 through 8.2.6 (fixed in 8.2.7)
- 8.3.0 (fixed in 8.3.1)
The source material lists only these ranges and does not enumerate every intermediate release within them. No CVSS score or formal severity rating was provided.
Detection and remediation
Detection. Defensive teams should monitor HTTP requests targeting the /public/plugins/ route for path traversal indicators, including literal ../ sequences and their URL-encoded equivalents. Alerts should fire on HTTP 200 responses from this route that return file contents inconsistent with expected plugin static assets. Requests that probe for known sensitive paths — such as /etc/passwd, grafana.ini, or /proc/self/environ — via the plugin resource route warrant immediate investigation. Correlating multiple distinct file-path requests from a single source against the /public/plugins/ route can indicate systematic file enumeration.
Remediation. The primary action is to upgrade to a fixed release — 8.0.7, 8.1.8, 8.2.7, or 8.3.1 or later — matching the affected minor branch. Until the upgrade is complete, restrict network access to the Grafana HTTP port to trusted users only. After remediation, review server files that may have been exposed — particularly the Grafana configuration file and process environment variables — and rotate any credentials, database connection strings, or secret keys that could have been read through this route.