Exploit

CVE-2024-9264

Improper Control of Generation of Code ('Code Injection') (CWE-94)

Published: Oct 18, 2024 / Updated: 33d ago

2316409 - grafana: Command injection and local file inclusion via SQL Expressions These SQL queries were incompletely sanitized, leading to a command injection and local file inclusion vulnerability.

http://grafana.com

Today we rolled out patch releases for Grafana 11.0.x, 11.1.x, and 11.2.x that contain a fix for CVE-2024-9264, a critical severity security vulnerability in Grafana that introduced command injection and local file inclusion (LFI) via SQL expressions. Note: Out of an abundance of caution, we are releasing two sets of security patches that contain the fix for this vulnerability.

AhnLab SEcurity intelligence Center (ASEC) investigated the vulnerability status of Grafana servers operating in Korea through the ASM service to assess the vulnerability threat exposure status of its clients. A critical security vulnerability in Grafana was announced and many Korean servers have been identified as using the vulnerable versions.

Nessus Plugin ID 211576 with High Severity Synopsis The remote host is missing a security update. Description The version of Grafana Labs installed on the remote host is affected by a vulnerability as referenced in the CVE-2024-9264 advisory. - The SQL Expressions experimental feature of Grafana allows for the evaluation of 'duckdb' queries containing user input. These queries are insufficiently sanitized before being passed to 'duckdb', leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or higher permission is capable of executing this attack. The 'duckdb' binary must be present in Grafana's $PATH for this attack to function; by default, this binary is not installed in Grafana distributions. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. Solution See vendor advisory Read more at https://www.tenable.com/plugins/nessus/211576

AhnLab SEcurity intelligence Center (ASEC) investigated the vulnerability status of Grafana servers operating in Korea through the ASM service to assess the vulnerability threat exposure status of its clients. A critical security vulnerability in Grafana was announced and many Korean servers have been identified as using the vulnerable versions.

Black Kite’s FocusTag™ for Atlassian Jira, published on November 13, 2024, enables TPRM professionals to identify vendors potentially affected by CVE-2021-26086. Third-Party Risk Management (TPRM) professionals should be concerned about CVE-2021-26086 because it allows unauthorized access to sensitive files on vulnerable Jira instances.

Black Kite’s FocusTag™ for CVE-2024-47939 was published on November 4, 2024, equipping TPRM professionals with actionable intelligence to identify and assess vendors utilizing vulnerable Ricoh printers and MFPs. By leveraging Black Kite’s platform, organizations can precisely filter and target vendors that operate affected Ricoh devices, thereby streamlining their risk assessment and mitigation processes. Have you configured firewall rules to block unauthorized IPs from accessing the device and limited access to the Web Image Monitor to trusted networks only to prevent potential exploitation of CVE-2024-47939?

Finally, execute the malicious payload to establish a reverse shell connection: In this step, we will write our reverse shell payload to the target machine: