Grafana SQL Expressions Flaw CVE-2024-9264 Lets Viewers Read and Write Files

·4 views

A vulnerability tracked as CVE-2024-9264 affects Grafana's SQL Expressions feature in releases from 11.0.0 through 11.1.6, with a narrower range in the 11.2 line. When the feature is enabled and a DuckDB binary is discoverable on the server, a user with the lowest authenticated Viewer role can pass SQL to that binary. Because DuckDB supports file reading, writing, and extension loading, this can enable arbitrary file reads and, depending on the Grafana process's permissions, file writes. Vendor scoring rates the issue 9.9, though some third-party summaries list 9.4. Proof-of-concept code appeared soon after disclosure, and the article notes that files such as provisioning configs, database files, and secret mounts could expose credentials.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How to Back Up Cyber Insurance Questionnaire Answers With Verifiable Evidence

A security consultant argues that cyber insurance questionnaire answers such as MFA coverage and EDR deployment should be backed by documented evidence rather than assumptions. The piece cites a 2022 case in which an insurer and a manufacturer agreed to rescind a policy after the insurer said MFA protected only the firewall, showing how unsupported answers can void coverage. It recommends using command-line exports and audits to find accounts lacking MFA, comparing EDR agents against asset inventories, checking email authentication records like DMARC, and keeping dated backup restore logs. The author suggests organizing evidence into dated folders starting about 90 days before policy renewal, and advises consulting a broker and coverage lawyer about rescission rules in one's state.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why DMARC fails even when SPF and DKIM pass: the role of domain alignment

A common situation after moving a DMARC policy beyond p=none is a message where SPF and DKIM both pass yet DMARC still fails. DMARC requires that at least one of these checks passes for the same domain shown in the visible From: header, a requirement known as alignment. Relaxed alignment, the default, accepts subdomains that share the organisational domain, while strict mode demands an exact match. Third-party services such as invoicing tools, CRMs and newsletter platforms often sign with their own domains, which causes this failure, and enabling custom domain authentication with the vendor usually resolves it. Forwarding and DKIM selector or key rotation problems can also break alignment, so administrators should review DMARC aggregate reports regularly and ramp enforcement gradually.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Four Tests to Run Before Taking a Polymarket Trading Bot Live

A profitable backtest does not guarantee a trading bot will perform well in live markets, since flawed assumptions can inflate simulated results. The article recommends checking four areas, starting with whether the strategy relies only on information that was actually available at decision time, to avoid look-ahead bias. It also warns that historical prices may not reflect executable fills, so entry prices and order liquidity should be tested for sensitivity. Results should remain positive after accounting for fees and other trading costs, especially for strategies built on frequent small gains. Finally, the author advises validating the strategy on out-of-sample data kept separate from development to reduce the risk of overfitting.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Calculate Average Order Value from Shopify Orders via the Admin GraphQL API

A developer explains how to compute average order value (AOV) from Shopify data by pulling orders through the Admin GraphQL API and calculating it in Node.js. The approach requires a custom app with an access token and the read_orders scope, which by default covers only the last 60 days of orders. The guide filters out test and cancelled orders and uses current price fields so refunds are already reflected in the totals. It reports two figures, one including shipping and taxes and one based on product subtotals alone. The post notes that the author works on a Shopify cart app, which is mentioned only at the end.

0 comments Read more at DEV Community