{"id":"CVE-2024-9264","published":"2024-10-18T03:20:52Z","modified":"2025-03-14T10:03:06Z","title":"Grafana SQL Expressions allow for remote code execution","vendor":"Grafana","product":"Grafana","tier":"core","eol":null,"affectedVersions":[{"vendor":"Grafana","product":"Grafana","versions":[">= 11.0.0, < 11.0.5",">= 11.1.0, < 11.1.6",">= 11.2.0, < 11.2.1",">= 11.0.0, < 11.0.6",">= 11.1.0, < 11.1.7",">= 11.2.0, < 11.2.2"]}],"description":{"text":"The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanitized before being passed to `duckdb`, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or higher permission is capable of executing this attack.  The `duckdb` binary must be present in Grafana's $PATH for this attack to function; by default, this binary is not installed in Grafana distributions.","provenance":"source","from":"CVE.org"},"summary":{"text":"The SQL Expressions experimental feature in Grafana, which evaluates DuckDB queries built from user input, fails to sanitise that input before passing it to DuckDB, enabling command injection and local file inclusion. An attacker with at least VIEWER permission on the network can exploit it without user interaction, provided the duckdb binary is present in Grafana's $PATH, which is not the default for Grafana distributions.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:11:52Z"},"cvss":{"score":9.9,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.97553,"percentile":0.99901,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":1,"pulses":[{"name":"Status of Korean Servers Exposed to Grafana Vulnerability (CVE-2024-9264) - ASEC","url":"https://otx.alienvault.com/pulse/673c944f09bdd4428998a5af","created":"2024-11-19"}],"provenance":"machine"},"cwes":[{"id":"CWE-94","name":"Improper Control of Generation of Code"}],"references":[{"url":"https://grafana.com/security/security-advisories/cve-2024-9264/","tags":[]},{"url":"https://security.netapp.com/advisory/ntap-20250314-0007/","tags":[]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Go","package":"github.com/grafana/grafana","vulnerableRanges":[">=11.0.0, <11.0.6+security-01",">=11.1.0, <11.1.7+security-01",">=11.2.0, <11.2.2+security-01","all versions"],"patched":["11.0.6+security-01","11.1.7+security-01","11.2.2+security-01"],"from":["GHSA-q99m-qcv4-fpm7","GO-2024-3215"],"provenance":"source"}],"advisories":[{"id":"GHSA-q99m-qcv4-fpm7","url":"https://github.com/advisories/GHSA-q99m-qcv4-fpm7","severity":"CRITICAL","ecosystem":"Go","package":"github.com/grafana/grafana","vulnerableRanges":[">=11.0.0, <11.0.6+security-01"],"patched":["11.0.6+security-01"],"provenance":"source","from":"GHSA"},{"id":"GHSA-q99m-qcv4-fpm7","url":"https://github.com/advisories/GHSA-q99m-qcv4-fpm7","severity":"CRITICAL","ecosystem":"Go","package":"github.com/grafana/grafana","vulnerableRanges":[">=11.1.0, <11.1.7+security-01"],"patched":["11.1.7+security-01"],"provenance":"source","from":"GHSA"},{"id":"GHSA-q99m-qcv4-fpm7","url":"https://github.com/advisories/GHSA-q99m-qcv4-fpm7","severity":"CRITICAL","ecosystem":"Go","package":"github.com/grafana/grafana","vulnerableRanges":[">=11.2.0, <11.2.2+security-01"],"patched":["11.2.2+security-01"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2024-3110","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-3110","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":11,"skipped":3,"earliest":"2024-10-19","earliestUrl":"https://github.com/nollium/CVE-2024-9264","repos":[{"name":"nollium/CVE-2024-9264","url":"https://github.com/nollium/CVE-2024-9264","stars":133,"created":"2024-10-19"},{"name":"z3k0sec/CVE-2024-9264-RCE-Exploit","url":"https://github.com/z3k0sec/CVE-2024-9264-RCE-Exploit","stars":38,"created":"2024-10-21"},{"name":"z3k0sec/File-Read-CVE-2024-9264","url":"https://github.com/z3k0sec/File-Read-CVE-2024-9264","stars":8,"created":"2024-10-20"},{"name":"Cythonic1/CVE-2024-9264","url":"https://github.com/Cythonic1/CVE-2024-9264","stars":3,"created":"2025-05-31"},{"name":"rvzsec/CVE-2024-9264","url":"https://github.com/rvzsec/CVE-2024-9264","stars":2,"created":"2025-07-07"}]},"metasploit":[{"name":"Grafana SQL Expressions DuckDB Command Injection","module":"exploit/multi/http/grafana_sql_expressions_rce_cve_2024_9264","type":"exploit","disclosureDate":"2024-10-17","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/grafana_sql_expressions_rce_cve_2024_9264.rb"}],"nuclei":[{"id":"CVE-2024-9264","name":"Grafana Post-Auth DuckDB - SQL Injection To File Read","severity":"critical","path":"http/cves/2024/CVE-2024-9264.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-9264.yaml"}],"first":{"date":"2024-10-17","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/grafana_sql_expressions_rce_cve_2024_9264.rb"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2024-10-17","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2024-10-19","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/grafana_sql_expressions_rce_cve_2024_9264.rb","provenance":"source"},{"date":"2024-10-18","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2024-9264","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":null},"priority":{"score":32.6,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.98,"detail":"percentile 0.9990"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"11 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.68,"detail":"1 pulse"},{"name":"CVSS severity","points":6.93,"detail":"base score 9.9"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"packageHistory":[{"cve":"CVE-2024-1442","published":"2024-03-07","fixed":"10.3.4","kev":false},{"cve":"CVE-2024-1313","published":"2024-03-26","fixed":"10.3.5","kev":false},{"cve":"CVE-2024-6322","published":"2024-08-20","fixed":"11.1.3","kev":false,"link":{"from":"CVE-2024-6322","to":"CVE-2024-9264","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/grafana/grafana","fromFixed":"11.1.3","toFixed":"11.1.7+security-01","daysApart":59}]}},{"cve":"CVE-2024-9264","published":"2024-10-18","fixed":"11.2.2+security-01","kev":false},{"cve":"CVE-2024-11741","published":"2025-01-31","fixed":"11.4.1","kev":false,"link":{"from":"CVE-2024-9264","to":"CVE-2024-11741","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/grafana/grafana","fromFixed":"11.2.2+security-01","toFixed":"11.2.6","daysApart":105}]}},{"cve":"CVE-2025-1088","published":"2025-06-18","fixed":"11.6.2","kev":false},{"cve":"CVE-2025-41115","published":"2025-11-21","fixed":"12.2.2","kev":false}],"package":"Go:github.com/grafana/grafana"}}