CVE-2024-9264
Grafana SQL Expressions allow for remote code execution
Severity Score
9.4
*CVSS v4
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
6
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
Attend
*SSVC
Descriptions
The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanitized before being passed to `duckdb`, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or higher permission is capable of executing this attack. The `duckdb` binary must be present in Grafana's $PATH for this attack to function; by default, this binary is not installed in Grafana distributions.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Attack Requirements
Privileges Required
User Interaction
System
Vulnerable | Subsequent
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:Attend
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2024-09-26 CVE Reserved
- 2024-10-18 CVE Published
- 2024-10-19 First Exploit
- 2024-11-01 CVE Updated
- 2024-11-02 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-94: Improper Control of Generation of Code ('Code Injection')
CAPEC
- CAPEC-242: Code Injection
References (7)
| URL | Date | SRC |
|---|---|---|
| https://github.com/z3k0sec/CVE-2024-9264-RCE-Exploit | 2024-10-24 | |
| https://github.com/nollium/CVE-2024-9264 | 2024-10-19 | |
| https://github.com/z3k0sec/File-Read-CVE-2024-9264 | 2024-10-21 | |
| https://github.com/zgimszhd61/CVE-2024-9264 | 2024-10-20 | |
| https://github.com/zgimszhd61/CVE-2024-9264-RCE | 2024-10-20 | |
| https://github.com/PunitTailor55/Grafana-CVE-2024-9264 | 2024-10-21 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Grafana Search vendor "Grafana" | Grafana Search vendor "Grafana" for product "Grafana" | >= 11.0.0 < 11.0.5 Search vendor "Grafana" for product "Grafana" and version " >= 11.0.0 < 11.0.5" | en |
Affected
| ||||||
| Grafana Search vendor "Grafana" | Grafana Search vendor "Grafana" for product "Grafana" | >= 11.1.0 < 11.1.6 Search vendor "Grafana" for product "Grafana" and version " >= 11.1.0 < 11.1.6" | en |
Affected
| ||||||
| Grafana Search vendor "Grafana" | Grafana Search vendor "Grafana" for product "Grafana" | >= 11.2.0 < 11.2.1 Search vendor "Grafana" for product "Grafana" and version " >= 11.2.0 < 11.2.1" | en |
Affected
| ||||||
| Grafana Search vendor "Grafana" | Grafana Search vendor "Grafana" for product "Grafana" | >= 11.0.0 < 11.0.6 Search vendor "Grafana" for product "Grafana" and version " >= 11.0.0 < 11.0.6" | en |
Affected
| ||||||
| Grafana Search vendor "Grafana" | Grafana Search vendor "Grafana" for product "Grafana" | >= 11.1.0 < 11.1.7 Search vendor "Grafana" for product "Grafana" and version " >= 11.1.0 < 11.1.7" | en |
Affected
| ||||||
| Grafana Search vendor "Grafana" | Grafana Search vendor "Grafana" for product "Grafana" | >= 11.2.0 < 11.2.2 Search vendor "Grafana" for product "Grafana" and version " >= 11.2.0 < 11.2.2" | en |
Affected
| ||||||