CVE-2024-9264

What it actually does

CVE-2024-9264 is a Grafana SQL Expressions flaw in which user-controlled input is insufficiently sanitized before being evaluated through DuckDB. An authenticated Grafana user with VIEWER or higher privileges can craft a SQL Expressions query that causes local file inclusion and, when the duckdb binary is available in Grafana's PATH, command injection. Successful exploitation can allow the attacker to read files accessible to the Grafana process and potentially execute operating-system commands as the Grafana service account. The issue is conditional on the experimental SQL Expressions feature and the presence of the duckdb binary, which is not installed by default in standard Grafana distributions.

Why it matters to the business

A low-privileged Grafana user account can potentially be turned into a foothold for server-side file theft or command execution. This can expose secrets stored on the Grafana host, data source credentials, configuration files, tokens, and other sensitive operational data, and may allow attackers to pivot into connected monitoring, cloud, or database environments. The vulnerability has weaponized exploit maturity and a very high EPSS score, so organizations running affected Grafana deployments should treat exposure as urgent even though it is not currently listed in CISA KEV. The affected product and fixed-version list supplied appears to reference Ubuntu kernel packages rather than Grafana; remediation should be based on Grafana vendor advisories and deployed Grafana versions, not unrelated kernel package versions.

How an attack unfolds

An attacker first obtains or compromises any Grafana account with VIEWER, EDITOR, or ADMIN permissions. They then identify whether SQL Expressions are enabled and whether the server can invoke duckdb from the Grafana process environment. The attacker submits a crafted request through Grafana's query APIs or UI-backed data query workflow that places malicious input into a SQL Expression. Because the input is not safely sanitized before DuckDB evaluation, the query can be abused to read local files or trigger command execution through the DuckDB execution path. If successful, the attacker retrieves sensitive files such as Grafana configuration, provisioned data source definitions, service account tokens, cloud credentials, or other files readable by the Grafana user. In a command-execution scenario, the attacker may stage a reverse shell, drop tooling, enumerate the host, harvest secrets, and pivot to systems reachable from the Grafana server.

How to fix it

Upgrade Grafana to a vendor-fixed release for the deployed major/minor branch. If immediate upgrade is not possible, disable the experimental SQL Expressions feature, remove duckdb from the Grafana service PATH if it is not explicitly required, and restrict Grafana access to trusted users and networks. Review all Grafana users and service accounts, especially accounts with VIEWER access that should not have broad visibility. Rotate secrets stored in or accessible by Grafana if exploitation is suspected, including data source credentials, API keys, service account tokens, cloud credentials, and database passwords. The fixed versions provided in the input are Ubuntu kernel package versions, such as linux 3.13.0-70.113 and linux-aws 4.4.0-1002.2, and do not correspond to the described Grafana vulnerability; do not treat those kernel updates as remediation for this Grafana issue.

How to confirm the fix worked

Confirm the running Grafana version is at or above the fixed version specified by Grafana for the installed branch. Verify SQL Expressions are disabled unless explicitly required. On the Grafana host, check whether duckdb is installed and reachable by the Grafana process using PATH inspection and package inventory. Validate that the Grafana service account cannot execute duckdb if the feature is not needed. Review Grafana configuration files, environment variables, systemd unit overrides, container images, and plugin/provisioning directories for references to SQL Expressions or DuckDB. Where safe and authorized, perform a non-destructive authenticated test using a low-privileged account to confirm crafted SQL Expression input is rejected or sanitized and cannot read local files. Recheck package inventories and container images after remediation to ensure older Grafana builds are not redeployed by automation.

Typical attack path

1. Acquire valid Grafana credentials for a user with VIEWER or higher privileges.
2. Confirm the target is running an affected Grafana version and that SQL Expressions are available.
3. Check whether the duckdb binary is installed and reachable in the Grafana service PATH, either directly through exploitation attempts or indirectly through behavior and error responses.
4. Send a crafted SQL Expressions query through Grafana query functionality, commonly via API requests associated with dashboard or panel queries.
5. Use the injection to read local files accessible to the Grafana process or to execute commands as the Grafana service account.
6. Extract Grafana configuration, data source credentials, tokens, or other secrets from the host.
7. Use stolen credentials or command execution to move laterally, access connected data sources, or establish persistence.

How to detect it

Hunt for authenticated Grafana users issuing unusual query requests, especially to data/query APIs used by dashboards or panels. Useful sources include Grafana server logs, reverse proxy and load balancer access logs, Grafana audit logs if enabled, systemd journal logs for the grafana-server service, container stdout/stderr, endpoint detection telemetry, process creation logs, shell history for the Grafana service account, and file access telemetry. Look for POST requests to Grafana query endpoints containing SQL Expressions, DuckDB references, local filesystem paths, command separators, encoded shell metacharacters, or attempts to read common sensitive files. On hosts, investigate any grafana-server process spawning duckdb, shells, curl, wget, nc, bash, sh, python, perl, or other interpreters. Review for unexpected files written in temporary directories, web-accessible directories, Grafana plugin directories, and provisioning paths. Examine whether sensitive files such as Grafana configuration, data source provisioning YAML files, service account tokens, SSH keys, cloud metadata credentials, or /etc/passwd were accessed around suspicious request times. If threat hunting finds likely exploitation, assume Grafana-held credentials may be compromised and rotate them.

• POST /api/ds/query
• POST /api/ds/query?
• /api/ds/query
• duckdb
• DuckDB
• sqlExpression
• SQL Expressions
• read_csv_auto(
• read_text(
• read_json_auto(
• COPY
• ATTACH
• INSTALL
• LOAD
• /etc/passwd
• /etc/shadow
• /var/lib/grafana/grafana.db
• /etc/grafana/grafana.ini
• /etc/grafana/provisioning/datasources/
• /var/lib/grafana/plugins/
• /proc/self/environ
• /proc/1/environ
• /root/.ssh/id_rsa
• /home/grafana/.ssh/id_rsa
• aws_access_key_id
• AWS_ACCESS_KEY_ID
• BEGIN RSA PRIVATE KEY
• BEGIN OPENSSH PRIVATE KEY
• grafana-server
• grafana-server spawned duckdb
• grafana-server spawned /bin/sh
• grafana-server spawned /bin/bash
• grafana-server spawned curl
• grafana-server spawned wget
• grafana-server spawned nc
• grafana-server spawned python
• /tmp/duckdb
• /tmp/grafana
• ;curl
• ;wget
• |curl
• |wget
• && curl
• && wget
• `curl
• $(curl

What your security team should do

• Immediately inventory all Grafana instances, including containers, embedded appliances, managed deployments, and internal monitoring stacks.
• Prioritize internet-facing or broadly accessible Grafana instances for upgrade because exploit code is weaponized and the EPSS score is very high.
• Upgrade Grafana to the appropriate vendor-fixed release and ensure deployment pipelines cannot roll back to vulnerable images.
• Disable SQL Expressions if not required, and remove or isolate the duckdb binary from Grafana hosts where possible.
• Restrict Grafana access using SSO, MFA, network controls, and least-privilege role assignments; treat VIEWER accounts as potentially exploitable for this issue.
• Hunt for suspicious Grafana query activity, especially POST requests to query endpoints containing DuckDB-related syntax, local file paths, shell metacharacters, or attempts to access sensitive files.
• If exploitation is plausible, rotate Grafana data source credentials, service account tokens, API keys, and any secrets readable by the Grafana process.
• Review Grafana audit logs, web access logs, system logs, and endpoint telemetry for command execution, unexpected child processes, or file reads by the Grafana process.
• Do not rely on the Ubuntu kernel fixed versions listed in the supplied product metadata as a fix for this Grafana vulnerability; validate against Grafana-specific advisories.