Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

An update on 0day CVE-2021-43798: Grafana directory traversal

grafana.com

Post reply on HN
Print view View original

1–10 of 26 posts

Re: An update on 0day CVE-2021-43798: Grafana directory traversal

#4

Post by graffgejrkk »

> 2021-12-03: Release plan set: 2021-12-07 for private customer release, 2021-12-14 for public release

Does someone know why they were playing on sitting on the public release for a week after private release?

Seems that by doing this they allowed it to become a 0day.

Re: An update on 0day CVE-2021-43798: Grafana directory traversal

#5

Post by alphahsl »

graffgejrkk wrote: post #4

> 2021-12-03: Release plan set: 2021-12-07 for private customer release, 2021-12-14 for public release Does someone know why they were playing on sitting on the public release for a week after private release? Seems that by doing this they allowed it to become a 0day.

> Customers get a week to upgrade under strict embargo

Seems that they can enforce an embargo with their private customers so that it won't become a 0day.

It became a 0day because the security researcher inadvertently kicked off public discussion.

Re: An update on 0day CVE-2021-43798: Grafana directory traversal

#6

Post by acdha »

nerdbaggy wrote: post #2

Good ol path traversal https://github.com/grafana/grafana/commit/c798c0e958d15d9cc7...

This part is kind of interesting — it looks like gosec at least gave the opportunity to catch this but that was missed due a misunderstanding of what was in scope for filepath.Clean:

https://github.com/grafana/grafana/commit/c798c0e958d15d9cc7...

Re: An update on 0day CVE-2021-43798: Grafana directory traversal

#8

Post by alphahsl »

alphahsl wrote: post #5
graffgejrkk wrote: post #4

> 2021-12-03: Release plan set: 2021-12-07 for private customer release, 2021-12-14 for public release Does someone know why they were playing on sitting on the public release for a week after private release? Seems that by doing this they allowed it to become a 0day.

> Customers get a week to upgrade under strict embargo Seems that they can enforce an embargo with their private customers so that it won't become a 0day. It became a 0day because the security researcher inadvertently kicked off public discussion.

I should clarify that “inadvertently” is the key word here. The 0day happened because of a number of factors detailed in the post, and it isn’t the fault of any one person.

Re: An update on 0day CVE-2021-43798: Grafana directory traversal

#10

Post by TheDong »

acdha wrote: post #6
nerdbaggy wrote: post #2

Good ol path traversal https://github.com/grafana/grafana/commit/c798c0e958d15d9cc7...

This part is kind of interesting — it looks like gosec at least gave the opportunity to catch this but that was missed due a misunderstanding of what was in scope for filepath.Clean: https://github.com/grafana/grafana/commit/c798c0e958d15d9cc7...

I mean, can you blame them?

The docs for filepath.Clean state the following:

    ...
    3. Eliminate each inner .. path name element (the parent directory)
       along with the non-.. element that precedes it.
    4. Eliminate .. elements that begin a rooted path:
       that is, replace "/.." by "/" at the beginning of a path,
       assuming Separator is '/'.
There is no mention that this function cannot be used for security, or that it does not safely ensure a path can't refer to a parent directory.

A quick reading of 3 and 4 will make you assume that a path has no ".."s after being "Clean"d. If you actually think about it more, you'll realize that of course it will leave ".." at the beginning of relative paths, but the docs do not make it clear, and I can understand why a programmer might reach for this.

There's no clearer function to reach for either, like "filepath.DirectoryContains(parent, path) bool".

Post reply on HN