Grafana - LFI Detection Scenario by crowdsecurity | CrowdSec Hub

Grafana - LFI

Attack scenariohttp:exploitMITRE T1190MITRE T1595cve.CVE-2021-43798

By: crowdsecurity
Version: 0.3
Name: crowdsecurity/grafana-cve-2021-43798
Remediation: Ban

Grafana - Arbitrary File Read (CVE-2021-43798)

Install with a top-level collection

16 collections include it

sudo cscli collections install crowdsecurity/whm

Installs 18 parsers and 66 scenarios, via HTTP - CVE Detection.

View WHM →

Installation

sudo cscli scenarios install crowdsecurity/grafana-cve-2021-43798

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

scenarios/crowdsecurity/grafana-cve-2021-43798.yaml· 22 linesGitHub

1type: trigger1
2format: 2.0
3name: crowdsecurity/grafana-cve-2021-43798
4description: "Grafana - Arbitrary File Read (CVE-2021-43798)"
5filter: |2
6  evt.Meta.log_type in ["http_access-log", "http_error-log"] and 
7    (Upper(evt.Meta.http_path) matches '/PUBLIC/PLUGINS/[^/]+/../[./]+/'
8    or
9    Upper(evt.Meta.http_path) matches '/PUBLIC/PLUGINS/[^/]+/%2E%2E/[%2E/]+/')
10groupby: "evt.Meta.source_ip"3
11blackhole: 2m4
12labels:
13  service: grafana
14  confidence: 3
15  spoofable: 0
16  classification:5
17    - attack.T1190
18    - attack.T1595
19    - cve.CVE-2021-43798
20  behavior: "http:exploit"
21  label: "Grafana - LFI"
22  remediation: true6

Installed on

Know where it runs

Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.

Documentation

Detect exploitation of CVE-2021-43798