CVE-2024-9264

The SQL Expressions experimental feature of Grafana allows for the evaluation of duckdb queries containing user input. These queries are insufficiently sanitized before being passed to duckdb, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or higher permission is capable of executing this attack. The duckdb binary must be present in Grafana's $PATH for this attack to function; by default, this binary is not installed in Grafana distributions.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/9xxx/CVE-2024-9264.json",
    "cna_assigner": "GRAFANA",
    "cwe_ids": [
        "CWE-94"
    ]
}

References

Affected packages

Git / github.com/grafana/grafana

Affected ranges

Type

GIT

Repo

https://github.com/grafana/grafana

Events

Introduced

277ef258d4b9a5acdf2932347c6a4ca72d739b28

Fixed

0421a8911cfc05a46c516fd9d033a51e52e51afe

Fixed

6c4158b30465e78c0a4a222f27e020b9c3073afb

Introduced

5b85c4c2fcf5d32d4f68aaef345c53096359b2f1

Fixed

b2c053e5b47cd7e83b3a80a6256f1dbb9ddc22a3

Fixed

dec13894710f1b3cd3d37a66d258f1d44536c4e5

Introduced

c57667e4481563f5e6cf945b03bc0626caa4dbeb

Fixed

086b47f098a2f2d27a6d538cf4bc523c892ecdd2

Fixed

c47b921ef40c0c411e9bad2cac05eb6c540c0979

Database specific

{
    "extracted_events": [
        {
            "introduced": "11.0.0"
        },
        {
            "fixed": "11.0.5"
        },
        {
            "fixed": "11.0.6"
        },
        {
            "introduced": "11.1.0"
        },
        {
            "fixed": "11.1.6"
        },
        {
            "fixed": "11.1.7"
        },
        {
            "introduced": "11.2.0"
        },
        {
            "fixed": "11.2.1"
        },
        {
            "fixed": "11.2.2"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

11.*

11.0.0

v11.*

v11.0.0

v11.0.1

v11.0.2

v11.0.4

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-9264.json"