Sigma rule: Grafana Path Traversal Exploitation CVE-2021-43798

Rule

Title

Grafana Path Traversal Exploitation CVE-2021-43798

Status

test

Level

critical

Author

Florian Roth (Nextron Systems)

Date

2021-12-08

Modified

2023-01-02

File

rules-emerging-threats/2021/Exploits/CVE-2021-43798/web_cve_2021_43798_grafana.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects a successful Grafana path traversal exploitation

Log source

category

webserver

Detection

selection_traversal:
    cs-uri-query|contains: '/../../../../../../../'
    sc-status: 200
selection_plugins:
    cs-uri-query|contains:
        - '/public/plugins/live'
        - '/public/plugins/icon'
        - '/public/plugins/loki'
        - '/public/plugins/text'
        - '/public/plugins/logs'
        - '/public/plugins/news'
        - '/public/plugins/stat'
        - '/public/plugins/mssql'
        - '/public/plugins/mixed'
        - '/public/plugins/mysql'
        - '/public/plugins/tempo'
        - '/public/plugins/graph'
        - '/public/plugins/gauge'
        - '/public/plugins/table'
        - '/public/plugins/debug'
        - '/public/plugins/zipkin'
        - '/public/plugins/jaeger'
        - '/public/plugins/geomap'
        - '/public/plugins/canvas'
        - '/public/plugins/grafana'
        - '/public/plugins/welcome'
        - '/public/plugins/xychart'
        - '/public/plugins/heatmap'
        - '/public/plugins/postgres'
        - '/public/plugins/testdata'
        - '/public/plugins/opentsdb'
        - '/public/plugins/influxdb'
        - '/public/plugins/barchart'
        - '/public/plugins/annolist'
        - '/public/plugins/bargauge'
        - '/public/plugins/graphite'
        - '/public/plugins/dashlist'
        - '/public/plugins/piechart'
        - '/public/plugins/dashboard'
        - '/public/plugins/nodeGraph'
        - '/public/plugins/alertlist'
        - '/public/plugins/histogram'
        - '/public/plugins/table-old'
        - '/public/plugins/pluginlist'
        - '/public/plugins/timeseries'
        - '/public/plugins/cloudwatch'
        - '/public/plugins/prometheus'
        - '/public/plugins/stackdriver'
        - '/public/plugins/alertGroups'
        - '/public/plugins/alertmanager'
        - '/public/plugins/elasticsearch'
        - '/public/plugins/gettingstarted'
        - '/public/plugins/state-timeline'
        - '/public/plugins/status-history'
        - '/public/plugins/grafana-clock-panel'
        - '/public/plugins/grafana-simple-json-datasource'
        - '/public/plugins/grafana-azure-monitor-datasource'
condition: all of selection*

False positives (as the rule lists them)

• Vulnerability scanners that scan a host that returns 200 status codes even in cases of a file not found or other error

Tags

• attack.initial-access
• attack.t1190
• cve.2021-43798
• detection.emerging-threats

CVEs this rule names

• CVE-2021-43798

MITRE ATT&CK ids this rule names

• T1190

References

• https://grafana.com/blog/2021/12/07/grafana-8.3.1-8.2.7-8.1.8-and-8.0.7-released-with-high-severity-security-fix/
• https://github.com/search?q=CVE-2021-43798

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2021/Exploits/CVE-2021-43798/web_cve_2021_43798_grafana.yml