CVE-2024-24824
published 2024-02-07CVE-2024-24824: Graylog is a free and open log management platform. Starting in version 2.0.0 and prior to versions 5.1.11 and 5.2.4, arbitrary classes can be loaded and…
PriorityP270high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
34.50%
98.2th percentile
Graylog is a free and open log management platform. Starting in version 2.0.0 and prior to versions 5.1.11 and 5.2.4, arbitrary classes can be loaded and instantiated using a HTTP PUT request to the `/api/system/cluster_config/` endpoint. Graylog's cluster config system uses fully qualified class names as config keys. To validate the existence of the requested class before using them, Graylog loads the class using the class loader. If a user with the appropriate permissions performs the request, arbitrary classes with 1-arg String constructors can be instantiated. This will execute arbitrary code that is run during class instantiation. In the specific use case of `java.io.File`, the behavior of the internal web-server stack will lead to information exposure by including the entire file content in the response to the REST request. Versions 5.1.11 and 5.2.4 contain a fix for this issue.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| graylog | graylog | >= 2.0.0 < 5.1.11 | 5.1.11 |
| graylog | graylog | >= 5.2.0 < 5.2.4 | 5.2.4 |
| graylog2 | graylog2-server | — | — |
| graylog2 | graylog2-server | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Graylog vulnerable to instantiation of arbitrary classes triggered by API request
osv·2024-02-07
CVE-2024-24824 [HIGH] Graylog vulnerable to instantiation of arbitrary classes triggered by API request
Graylog vulnerable to instantiation of arbitrary classes triggered by API request
### Summary
Arbitrary classes can be loaded and instantiated using a HTTP PUT request to the `/api/system/cluster_config/` endpoint.
### Details
Graylog's cluster config system uses fully qualified class names as config keys. To validate the existence of the requested class before using them, Graylog loads the class using the class loader.
https://github.com/Graylog2/graylog2-server/blob/e458db8bf4f789d4d19f1b37f0263f910c8d036c/graylog2-server/src/main/java/org/graylog2/rest/resources/system/ClusterConfigResource.java#L208-L214
### PoC
A request of the following form will output the content of the `/etc/passwd` file:
```
curl -u admin: -X PUT http://localhost:9000/api/system/cluster_config/java.io.Fil
GHSA
Graylog vulnerable to instantiation of arbitrary classes triggered by API request
ghsa·2024-02-07
CVE-2024-24824 [HIGH] CWE-284 Graylog vulnerable to instantiation of arbitrary classes triggered by API request
Graylog vulnerable to instantiation of arbitrary classes triggered by API request
### Summary
Arbitrary classes can be loaded and instantiated using a HTTP PUT request to the `/api/system/cluster_config/` endpoint.
### Details
Graylog's cluster config system uses fully qualified class names as config keys. To validate the existence of the requested class before using them, Graylog loads the class using the class loader.
https://github.com/Graylog2/graylog2-server/blob/e458db8bf4f789d4d19f1b37f0263f910c8d036c/graylog2-server/src/main/java/org/graylog2/rest/resources/system/ClusterConfigResource.java#L208-L214
### PoC
A request of the following form will output the content of the `/etc/passwd` file:
```
curl -u admin: -X PUT http://localhost:9000/api/system/cluster_config/java.io.Fil
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/Graylog2/graylog2-server/blob/e458db8bf4f789d4d19f1b37f0263f910c8d036c/graylog2-server/src/main/java/org/graylog2/rest/resources/system/ClusterConfigResource.java#L208-L214https://github.com/Graylog2/graylog2-server/commit/75ef2b8d60e7d67f859b79fe712c8ae7b2e861d8https://github.com/Graylog2/graylog2-server/commit/7f8ef7fa8edf493106d5ef6f777d4da02c5194d9https://github.com/Graylog2/graylog2-server/security/advisories/GHSA-p6gg-5hf4-4rgjhttps://github.com/Graylog2/graylog2-server/blob/e458db8bf4f789d4d19f1b37f0263f910c8d036c/graylog2-server/src/main/java/org/graylog2/rest/resources/system/ClusterConfigResource.java#L208-L214https://github.com/Graylog2/graylog2-server/commit/75ef2b8d60e7d67f859b79fe712c8ae7b2e861d8https://github.com/Graylog2/graylog2-server/commit/7f8ef7fa8edf493106d5ef6f777d4da02c5194d9https://github.com/Graylog2/graylog2-server/security/advisories/GHSA-p6gg-5hf4-4rgj
2024-02-07
Published