CVE-2024-9264

Description

The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanitized before being passed to `duckdb`, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or higher permission is capable of executing this attack. The `duckdb` binary must be present in Grafana's $PATH for this attack to function; by default, this binary is not installed in Grafana distributions.

References

https://www.scworld.com/news/grafana-critical-vulnerability-risks-remote-code-execution

https://grafana.com/security/security-advisories/cve-2024-9264/

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

CVSS v4