search

golang / vulndb

[mirror] The Go Vulnerability Database
Other
565 stars 61 forks source link

x/vulndb: potential Go vuln in github.com/grafana/grafana: GHSA-q99m-qcv4-fpm7 #3215

Closed GoVulnBot closed 1 month ago

GoVulnBot commented 1 month ago

Advisory GHSA-q99m-qcv4-fpm7 references a vulnerability in the following Go modules:

Module
github.com/grafana/grafana

Description: The SQL Expressions experimental feature of Grafana allows for the evaluation of duckdb queries containing user input. These queries are insufficiently sanitized before being passed to duckdb, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or higher permission is capable of executing this attack. The duckdb binary must be present in Grafana's $PATH for this attack to function; by default, this binary is not installed in Grafana distributions.

References:

Cross references:

See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/grafana/grafana
      non_go_versions:
        - introduced: TODO (earliest fixed "11.2.2+security-01", vuln range ">= 11.2.0, <= 11.2.2")
        - introduced: TODO (earliest fixed "11.1.7+security-01", vuln range ">= 11.1.0, <= 11.1.7")
        - introduced: TODO (earliest fixed "11.0.6+security-01", vuln range ">= 11.0.0, <= 11.0.6")
      vulnerable_at: 5.4.5+incompatible
summary: Grafana Command Injection And Local File Inclusion Via Sql Expressions in github.com/grafana/grafana
cves:
    - CVE-2024-9264
ghsas:
    - GHSA-q99m-qcv4-fpm7
references:
    - advisory: https://github.com/advisories/GHSA-q99m-qcv4-fpm7
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-9264
    - fix: https://github.com/grafana/grafana/pull/81666
    - web: https://grafana.com/blog/2024/10/17/grafana-security-release-critical-severity-fix-for-cve-2024-9264
    - web: https://grafana.com/security/security-advisories/cve-2024-9264
notes:
    - fix: 'module merge error: could not merge versions of module github.com/grafana/grafana: invalid or non-canonical semver version (found TODO (earliest fixed "11.2.2+security-01", vuln range ">= 11.2.0, <= 11.2.2"))'
source:
    id: GHSA-q99m-qcv4-fpm7
    created: 2024-10-25T15:01:24.992256131Z
review_status: UNREVIEWED
gopherbot commented 1 month ago

Change https://go.dev/cl/622835 mentions this issue: data/reports: add 16 unreviewed reports