~ / search / GHSA-q99m-qcv4-fpm7

GHSA-q99m-qcv4-fpm7

Grafana Command Injection And Local File Inclusion Via Sql Expressions

Source: GitHub Advisory Database (reviewed) Critical CVE-2024-9264

Packages

EcosystemPackageAffectedFixed in
Go github.com/grafana/grafana >= 11.0.0, < 11.0.6+security-01 11.0.6+security-01
Go github.com/grafana/grafana >= 11.1.0, < 11.1.7+security-01 11.1.7+security-01
Go github.com/grafana/grafana >= 11.2.0, < 11.2.2+security-01 11.2.2+security-01

Details

As written in the advisory (Markdown source, shown as plain text).

The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanitized before being passed to `duckdb`, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or higher permission is capable of executing this attack. The `duckdb` binary must be present in Grafana's $PATH for this attack to function; by default, this binary is not installed in Grafana distributions.

References

External links from the advisory. They lead to third-party sites.