Riskcovery

CVE-2024-9264

Grafana SQL Expressions allow for remote code execution

State
Published
Severity
9.4 Critical
Published
Oct 18, 2024
Updated
Mar 14, 2025
Reserved
Sep 26, 2024

Read the record on cve.org

Description

The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanitized before being passed to `duckdb`, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or higher permission is capable of executing this attack. The `duckdb` binary must be present in Grafana's $PATH for this attack to function; by default, this binary is not installed in Grafana distributions.

Scores

CVSSScoreVectorSource
4.09.4 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:HGRAFANA
3.19.9 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HGRAFANA

Weaknesses

  • CWE-94 Improper Control of Generation of Code ('Code Injection')

Affected Products

ProductVersions
GrafanaGrafana
  • 11.0.0 to before 11.0.5Affectedfrom +security-01Not affected
  • 11.1.0 to before 11.1.6Affectedfrom +security-01Not affected
  • 11.2.0 to before 11.2.1Affectedfrom +security-01Not affected
  • 11.0.0 to before 11.0.6Affectedfrom +security-01Not affected
  • 11.1.0 to before 11.1.7Affectedfrom +security-01Not affected
  • 11.2.0 to before 11.2.2Affectedfrom +security-01Not affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.