CVE-2024-9264
Fixed in a distro release EPSS 98%CVSS 9.9
The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanitized before being passed to `duckdb`, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or higher permission is capable of executing this attack. The `duckdb` binary must be present in Grafana's $PATH for this attack to function; by default, this binary is not installed in Grafana distributions.
Products: grafana
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/grafana/grafana | 11.0.6+security-01 |
| Go | github.com/grafana/grafana | 11.1.7+security-01 |
| Go | github.com/grafana/grafana | 11.2.2+security-01 |
| Go | github.com/grafana/grafana | no fix |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | grafana-11.0 | 11.0.7-r0 |
| Chainguard | grafana-fips-11.0 | 11.0.7-r0 |
| Chainguard | grafana-fips-11.0-oci-compat | 11.0.7-r0 |
| Chainguard | grafana-fips-11.6 | 0 |
| Chainguard | grafana-fips-12.0 | 12.0.10-r6 |
| Chainguard | grafana-fips-12.1 | 12.1.10.01-r3 |
| Chainguard | grafana-fips-12.2 | 0 |
| Chainguard | grafana-fips-12.3 | 0 |
| Chainguard | grafana-fips-12.4 | 0 |
| Chainguard | grafana-fips-13.0 | 0 |
| Chainguard | grafana-fips-13.1 | 13.1.0-r0 |
| Chainguard | grafana-oci-compat | 11.0.7-r0 |
| SUSE:Linux Enterprise Module for Package Hub 15 SP5 | govulncheck-vulndb | 0.0.20241030T212825-150000.1.9.1 |
| SUSE:Linux Enterprise Module for Package Hub 15 SP6 | govulncheck-vulndb | 0.0.20241030T212825-150000.1.9.1 |
| SUSE:Linux Enterprise Module for Package Hub 15 SP6 | grafana | 11.5.5-150200.3.72.2 |
| SUSE:Linux Enterprise Module for Package Hub 15 SP7 | grafana | 11.5.5-150200.3.72.2 |
| SUSE:Linux Enterprise Server 12 SP5-LTSS | golang-github-prometheus-node_exporter | 1.9.1-1.36.2 |
| SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | golang-github-prometheus-node_exporter | 1.9.1-1.36.2 |
| SUSE:Manager Client Tools 12 | golang-github-prometheus-alertmanager | 0.26.0-1.31.2 |
| SUSE:Manager Client Tools 12 | golang-github-prometheus-node_exporter | 1.9.1-1.36.2 |
| SUSE:Manager Client Tools 12 | golang-github-prometheus-prometheus | 2.53.4-1.60.2 |
| SUSE:Manager Client Tools 12 | grafana | 11.5.5-1.79.2 |
| SUSE:Manager Client Tools 12 | prometheus-blackbox_exporter | 0.26.0-1.27.1 |
| SUSE:Manager Client Tools 15 | golang-github-prometheus-prometheus | 2.53.4-150000.3.62.2 |
| SUSE:Manager Client Tools 15 | grafana | 11.5.5-150000.1.79.1 |
| SUSE:Manager Client Tools 15 | prometheus-blackbox_exporter | 0.26.0-150000.1.27.1 |
| SUSE:Manager Client Tools for SLE Micro 5 | prometheus-blackbox_exporter | 0.26.0-150000.1.27.1 |
| SUSE:Manager Proxy Module 4.3 | prometheus-blackbox_exporter | 0.26.0-150000.1.27.1 |
| SUSE:Manager Server 4.3 | release-notes-susemanager | 4.3.15.2-150400.3.133.1 |
| SUSE:Package Hub 12 | govulncheck-vulndb | 0.0.20241104T154416-5.1 |
| Ubuntu:16.04:LTS | grafana | no fix |
| openSUSE:Leap 15.5 | govulncheck-vulndb | 0.0.20241030T212825-150000.1.9.1 |
| openSUSE:Leap 15.6 | govulncheck-vulndb | 0.0.20241030T212825-150000.1.9.1 |
| openSUSE:Leap 15.6 | grafana | 11.5.5-150200.3.72.2 |
| openSUSE:Leap 15.6 | prometheus-blackbox_exporter | 0.26.0-150000.1.27.1 |
| openSUSE:Tumbleweed | govulncheck-vulndb | 0.0.20241030T212825-1.1 |
| openSUSE:Tumbleweed | grafana | 11.3.0-1.1 |