How NOT to use DuckDB: How we introduced a CVSS 9.9 vulnerability into
summary
Grafana integrates DuckDB via the CLI and ships it behind a feature flag, which enables dot commands (shell/system) and file readers like read_blob inside SQL; that combination creates CVSS 9.9 remote code execution and local file inclusion on multi-tenant instances. A few customers required the feature to be switched off, no evidence of exploitation was found, and fixes required private repo patches and rebuilt binaries; current mitigation is using an embedded version or a pure-Go SQL engine instead.
AI-written summary · about
chapters (7)
- 0:00Integrating DuckDB in Grafana
- 1:34Discovering a security risk
- 2:18Analyzing the vulnerability
- 3:00Security impact and remediation
- 3:56Root cause of implementation
- 4:39Lessons learned
- 5:12Q&A and architectural insights
related talks
25mStorage and encryption in DuckDB
45mGo security pitfalls; 2 lessons from the battlefield at Grafana Labs
33mFrogs and Ducks, Your Sentinels for Open Source Security
52mThe trouble with extensions
48mTackling the Recent Rise of Cross-Tenant Vulnerabilities
01h 02mPrompt-Jacking: The Rise of a New Supply Chain Risk
40mSecuring your dependencies
59mDon't Get Burned! Secure Coding Essentials to Protect Your Application