This critical path traversal vulnerability in Grafana is currently being actively exploited in the wild, allowing unauthenticated attackers to read sensitive files from the server.

The application is susceptible to a directory traversal vulnerability (CWE-22) residing in the plugin API endpoint. An unauthenticated attacker can craft a malicious URL request to access files outside of the intended web root, facilitating unauthorized local file inclusion and data exfiltration.

The CVSS score of 9.5 reflects the extreme severity of this flaw, as it allows complete unauthorized access to sensitive configuration files, credentials, or system data stored on the host. This exposure can lead to full system compromise, lateral movement within the network, and severe reputational damage. Given the ease of exploitation, the risk to business continuity is critical.

Immediate Action: Upgrade to Grafana version 8.0.7, 8.1.8, 8.2.7, or 8.3.1 immediately to patch the vulnerability.

Proactive Monitoring: Monitor web server logs for requests containing suspicious directory traversal patterns, such as sequences of double dots and slashes directed toward the /public/plugins/ endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules designed to block path traversal attempts and filter requests containing suspicious plugin path parameters as a temporary measure until updates are applied.

Public Exploit Available: Yes, a Metasploit module and ExploitDB entry exist.

Due to the confirmed active exploitation and the critical nature of this path traversal vulnerability, immediate action is required. Organizations must prioritize upgrading their Grafana instances to the specified patched versions. Failure to remediate this vulnerability exposes the environment to significant risk of unauthorized data access and potential full system takeover.