CVE-2024-9264

The SQL Expressions feature allows evaluation of duckdb queries with user-provided input data. Due to insufficient sanitization of this input data before passing it to the duckdb process, an attacker can inject malicious system commands or references to local files. The attack requires the presence of the duckdb binary in the $PATH environment variable of the Grafana server — it is not installed by default in standard Grafana distributions.

An attacker with VIEWER privileges or higher can execute arbitrary system commands on the server (command injection) and read any local files (local file inclusion), which may result in complete server takeover and disclosure of sensitive data.

Apply patches available from the vendor according to references (https://grafana.com/security/security-advisories/cve-2024-9264/). As a workaround, ensure that the duckdb binary is NOT present in the $PATH of the Grafana server and disable the experimental SQL Expressions feature if it is not required.

Grafana with the experimental SQL Expressions feature enabled and duckdb binary present in $PATH — versions indicated in vendor references