// For flags

CVE-2024-24824

graylog2-server vulnerable to instantiation of arbitrary classes triggered by API request

Severity Score

8.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Graylog is a free and open log management platform. Starting in version 2.0.0 and prior to versions 5.1.11 and 5.2.4, arbitrary classes can be loaded and instantiated using a HTTP PUT request to the `/api/system/cluster_config/` endpoint. Graylog's cluster config system uses fully qualified class names as config keys. To validate the existence of the requested class before using them, Graylog loads the class using the class loader. If a user with the appropriate permissions performs the request, arbitrary classes with 1-arg String constructors can be instantiated. This will execute arbitrary code that is run during class instantiation. In the specific use case of `java.io.File`, the behavior of the internal web-server stack will lead to information exposure by including the entire file content in the response to the REST request. Versions 5.1.11 and 5.2.4 contain a fix for this issue.

Graylog es una plataforma de gestión de registros abierta y gratuita. A partir de la versión 2.0.0 y anteriores a las versiones 5.1.11 y 5.2.4, se pueden cargar y crear instancias de clases arbitrarias mediante una solicitud HTTP PUT al endpoint `/api/system/cluster_config/`. El sistema de configuración del clúster de Graylog utiliza nombres de clases completos como claves de configuración. Para validar la existencia de la clase solicitada antes de usarlas, Graylog carga la clase usando el cargador de clases. Si un usuario con los permisos adecuados realiza la solicitud, se pueden crear instancias de clases arbitrarias con constructores String de 1 argumento. Esto ejecutará código arbitrario que se ejecuta durante la creación de instancias de clase. En el caso de uso específico de `java.io.File`, el comportamiento de la pila interna del servidor web provocará la exposición de la información al incluir todo el contenido del archivo en la respuesta a la solicitud REST. Las versiones 5.1.11 y 5.2.4 contienen una solución para este problema.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
Single
Confidentiality
Complete
Integrity
Complete
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2024-01-31 CVE Reserved
  • 2024-02-07 CVE Published
  • 2024-08-01 CVE Updated
  • 2024-08-01 First Exploit
  • 2025-01-07 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-284: Improper Access Control
  • CWE-863: Incorrect Authorization
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Graylog
Search vendor "Graylog"
 Graylog
Search vendor "Graylog" for product "Graylog"
 >= 2.0.0 < 5.1.11
Search vendor "Graylog" for product "Graylog" and version " >= 2.0.0 < 5.1.11"
-
Affected
Graylog
Search vendor "Graylog"
 Graylog
Search vendor "Graylog" for product "Graylog"
 >= 5.2.0 < 5.2.4
Search vendor "Graylog" for product "Graylog" and version " >= 5.2.0 < 5.2.4"
-
Affected