Grafana Command Injection And Local File Inclusion Via Sql Expressions

高 8.8CVE-2024-9264 · BIT-grafana-2024-9264 · GHSA-q99m-qcv4-fpm7 · 18/10/2024 公開 · 17/06/2026 更新

要点

CVE-2024-9264 は github.com/grafana/grafana, grafana (grafana) に影響する深刻度「高」 (CVSS 8.8) の脆弱性です。
今後30日間に悪用される確率（EPSS）：97.6%（全脆弱性の 99.9% より高い）。
対処：11.0.6+security-01, 11.1.7+security-01, 11.2.2+security-01 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
github.com/grafana/grafana Go	`≥ 11.0.0, < 11.0.6+security-01≥ 11.1.0, < 11.1.7+security-01≥ 11.2.0, < 11.2.2+security-01全バージョン`	`11.0.6+security-0111.1.7+security-0111.2.2+security-01`
grafana grafana	`= 11.0.0`	修正版なし

概要

The SQL Expressions experimental feature of Grafana allows for the evaluation of duckdb queries containing user input. These queries are insufficiently sanitized before being passed to duckdb, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or higher permission is capable of executing this attack. The duckdb binary must be present in Grafana's $PATH for this attack to function; by default, this binary is not installed in Grafana distributions.

NVD の説明

The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanitized before being passed to `duckdb`, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or higher permission is capable of executing this attack. The `duckdb` binary must be present in Grafana's $PATH for this attack to function; by default, this binary is not installed in Grafana distributions.