Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

An update on 0day CVE-2021-43798: Grafana directory traversal

grafana.com

Post reply on HN
Print view View original

21–26 of 26 posts

Re: An update on 0day CVE-2021-43798: Grafana directory traversal

#22

Post by acdha »

TheDong wrote: post #10
acdha wrote: post #6

Earlier quoted context omitted.

This part is kind of interesting — it looks like gosec at least gave the opportunity to catch this but that was missed due a misunderstanding of what was in scope for filepath.Clean: https://github.com/grafana/grafana/commit/c798c0e958d15d9cc7...

I mean, can you blame them? The docs for filepath.Clean state the following: ... 3. Eliminate each inner .. path name element (the parent directory) along with the non-.. element that precedes it. 4. Eliminate .. elements that begin a rooted path: that is, replace "/.." by "/" at the beginning of a path, assuming Separator is '/'. There is no mention that this function cannot be used for security, or that it does not…

Just to be clear, I’m not blaming them. I should have clarified that I was thinking along the lines of “how could the tool/documentation have made it easier to recognize that gap?” — and I especially agree with your suggestion that there could be a solid library improvement with a purpose-built function which is clearly identified as the right way to address this relatively common need.

Re: An update on 0day CVE-2021-43798: Grafana directory traversal

#23

Post by remram »

404mm wrote: post #3

Affects all 8.x releases

I just realized I'm still on 7.3 because I could never get the image renderer to work on 8.x (the thing that shows the graph in the alert email). Anyone got a Docker image that will render images out of the box?

[edit: Just installed 8.3. Alert conditions warn they are now "beta feature" and "could stop working in next version". Is Grafana removing features every release?]

Re: An update on 0day CVE-2021-43798: Grafana directory traversal

#24

Post by remram »

Beltiras wrote: post #20

Note: postmortem has a more dire meaning in non-tech circles (literally means "after death"). You want to say retrospective instead. I know it's a difference in culture.

I think people used to publish "postmortems" for projects that were literally over, either because they failed or because they were published long ago. At some point people started using it for outages, then security issues too.

I agree that the term is inadequate, I can just see how we got here.

Post reply on HN