CVE-2024-9264
CVE-2024-9264 · Grafana SQL Expressions allow for remote code execution
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanitized before being passed to `duckdb`, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or higher permission is capable of executing this attack. The `duckdb` binary must be present in Grafana's $PATH for this attack to function; by default, this binary is not installed in Grafana distributions.
CVSS 9.4 · Critical · EPSS 97.6% · Public exploit · Fix available
- Published
- Updated
Stack: system · applications
Affected products and versions
grafana
- Versions
- ≥ 11.0.0, < 11.0.5: Affected; ≥ +security-01: Not affected (semver)
- ≥ 11.1.0, < 11.1.6: Affected; ≥ +security-01: Not affected (semver)
- ≥ 11.2.0, < 11.2.1: Affected; ≥ +security-01: Not affected (semver)
- ≥ 11.0.0, < 11.0.6: Affected; ≥ +security-01: Not affected (semver)
- ≥ 11.1.0, < 11.1.7: Affected; ≥ +security-01: Not affected (semver)
- ≥ 11.2.0, < 11.2.2: Affected; ≥ +security-01: Not affected (semver)
Update to 11.0.6; Update to 11.1.7; Update to 11.2.2
grafana Ubuntu:16.04:LTS
- Versions
- 2.6.0+dfsg-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published