CVE-2024-9264

Red Hat statement

This vulnerability is classified as critical instead of important because it allows for command injection and local file inclusion, potentially leading to arbitrary code execution or unauthorized access to sensitive files. The exploit can be carried out by any user with VIEWER or higher permissions, significantly increasing the attack surface. Moreover, due to an incorrect implementation of feature flags, the SQL Expressions feature is enabled by default for the API, making it more likely to be exposed in affected deployments. Although the vulnerability requires the presence of the DuckDB binary in the Grafana process's PATH, systems that meet this condition are at significant risk. It’s important to note that this issue was introduced in a Grafana version not included in any Red Hat offerings, ensuring that Red Hat customers are not impacted.

Red Hat mitigation

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.