Emerging Threatcriticaltest

Grafana Path Traversal Exploitation CVE-2021-43798

Detects a successful Grafana path traversal exploitation

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Florian Roth (Nextron Systems)Created Wed Dec 08Updated Mon Jan 027b72b328-5708-414f-9a2a-6a6867c26e162021

Emerging Threat

Active Threat

Developed to detect an active or emerging threat. Prioritize investigation of any alerts and correlate with threat intelligence.

Log Source

Web Server Log

CategoryWeb Server Log← raw: webserver

HTTP access logs from web servers capturing request paths, methods, and status codes.

Detection Logic

detection:
    selection_traversal:
        cs-uri-query|contains: '/../../../../../../../'
        sc-status: 200
    selection_plugins:
        cs-uri-query|contains:
            - '/public/plugins/live'
            - '/public/plugins/icon'
            - '/public/plugins/loki'
            - '/public/plugins/text'
            - '/public/plugins/logs'
            - '/public/plugins/news'
            - '/public/plugins/stat'
            - '/public/plugins/mssql'
            - '/public/plugins/mixed'
            - '/public/plugins/mysql'
            - '/public/plugins/tempo'
            - '/public/plugins/graph'
            - '/public/plugins/gauge'
            - '/public/plugins/table'
            - '/public/plugins/debug'
            - '/public/plugins/zipkin'
            - '/public/plugins/jaeger'
            - '/public/plugins/geomap'
            - '/public/plugins/canvas'
            - '/public/plugins/grafana'
            - '/public/plugins/welcome'
            - '/public/plugins/xychart'
            - '/public/plugins/heatmap'
            - '/public/plugins/postgres'
            - '/public/plugins/testdata'
            - '/public/plugins/opentsdb'
            - '/public/plugins/influxdb'
            - '/public/plugins/barchart'
            - '/public/plugins/annolist'
            - '/public/plugins/bargauge'
            - '/public/plugins/graphite'
            - '/public/plugins/dashlist'
            - '/public/plugins/piechart'
            - '/public/plugins/dashboard'
            - '/public/plugins/nodeGraph'
            - '/public/plugins/alertlist'
            - '/public/plugins/histogram'
            - '/public/plugins/table-old'
            - '/public/plugins/pluginlist'
            - '/public/plugins/timeseries'
            - '/public/plugins/cloudwatch'
            - '/public/plugins/prometheus'
            - '/public/plugins/stackdriver'
            - '/public/plugins/alertGroups'
            - '/public/plugins/alertmanager'
            - '/public/plugins/elasticsearch'
            - '/public/plugins/gettingstarted'
            - '/public/plugins/state-timeline'
            - '/public/plugins/status-history'
            - '/public/plugins/grafana-clock-panel'
            - '/public/plugins/grafana-simple-json-datasource'
            - '/public/plugins/grafana-azure-monitor-datasource'
    condition: all of selection*