ID:13121 - Exploit for PHP file inclusion in Grafana - CVE-2024-9264

Link to public exploit:

Vulnerability description

The vulnerability allows a remote user to include and execute arbitrary PHP files on the server.

The vulnerability exists due to improper input validation when handling data passed to "duckdb". A remote user with VIEWER permissions include and execute arbitrary PHP on the system with privileges of the web server.

Note, the duckdb binary must be present in Grafana’s $PATH for this attack to function. By default, this binary is not installed in Grafana distributions.

Remediation