CVE-2024-9264 Grafana SQL Expressions allow for remote code execution
Attackers with viewer permissions can execute arbitrary commands and read local files via unsanitized SQL expressions if the duckdb binary is installed.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-9264?
CVE-2024-9264 is a critical command injection vulnerability in Grafana Grafana, published on 18 Oct 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanitized before being passed to `duckdb`, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or higher permission is capable of executing this attack. The `duckdb` binary must be present in Grafana's $PATH for this attack to function; by default, this binary is not installed in Grafana distributions.
Which versions are affected by CVE-2024-9264?
8 open source packages ship an affected version, including github.com/grafana/grafana and grafana. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/grafana/grafana Go | All versions | None |
github.com/grafana/grafana Go | From 11.0.0 | 11.0.6+security-01 |
github.com/grafana/grafana Go | From 11.0.0 | 11.0.6+security-01 |
github.com/grafana/grafana Go | From 11.1.0 | 11.1.7+security-01 |
github.com/grafana/grafana Go | From 11.1.0 | 11.1.7+security-01 |
github.com/grafana/grafana Go | From 11.2.0 | 11.2.2+security-01 |
2 more packages
github.com/grafana/grafana Go | From 11.2.0 | 11.2.2+security-01 |
grafana Bitnami | From 11.0.0 | 11.2.2 |
Products include Grafana Grafana.
How do I fix CVE-2024-9264?
Upgrade github.com/grafana/grafana to a fixed version for your release line: 11.0.6+security-01, 11.1.7+security-01 or 11.2.2+security-01.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2024-9264 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-9264 exists.
Public exploit code: 1 Metasploit module, 1 Nuclei template and 14 proofs of concept on GitHub.
Other vulnerabilities in Grafana Grafana
Sources
Also known as BIT-grafana-2024-9264, GHSA-q99m-qcv4-fpm7, GO-2024-3215, MINI-46wj-669r-wqqp, MINI-72gw-xxrx-hqq8, MINI-777w-phrm-h39p and 15 more.