CVE-2024-9264

A vulnerability was found in Grafana. An experimental feature named SQL Expressions was recently added to Grafana to allow query output to be post-processed using SQL. These SQL queries were incompletely sanitized, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or higher permission can execute this attack.

This vulnerability is classified as critical instead of important because it allows for command injection and local file inclusion, potentially leading to arbitrary code execution or unauthorized access to sensitive files. The exploit can be carried out by any user with VIEWER or higher permissions, significantly increasing the attack surface. Moreover, due to an incorrect implementation of feature flags, the SQL Expressions feature is enabled by default for the API, making it more likely to be exposed in affected deployments. Although the vulnerability requires the presence of the DuckDB binary in the Grafana process's PATH, systems that meet this condition are at significant risk.

It’s important to note that this issue was introduced in a Grafana version not included in any Red Hat offerings, ensuring that Red Hat customers are not impacted.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.