GHSA-p6gg-5hf4-4rgj CVE-2024-24824

Graylog vulnerable to instantiation of arbitrary classes triggered by API request

High Maven

Severity: 8.8 / 10; High · CVSS 3.1
Exploit chance (EPSS): 34.74%; Chance of exploitation in the next 30 days. Higher than 98.42% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-284 Improper Access Control
Fix: 5.1.11; Upgrade org.graylog2:graylog2-server to this version or later

Description

Summary

Arbitrary classes can be loaded and instantiated using a HTTP PUT request to the /api/system/cluster_config/ endpoint.

Details

Graylog's cluster config system uses fully qualified class names as config keys. To validate the existence of the requested class before using them, Graylog loads the class using the class loader.

https://github.com/Graylog2/graylog2-server/blob/e458db8bf4f789d4d19f1b37f0263f910c8d036c/graylog2-server/src/main/java/org/graylog2/rest/resources/system/ClusterConfigResource.java#L208-L214

PoC

A request of the following form will output the content of the /etc/passwd file:

curl -u admin:<admin-password> -X PUT http://localhost:9000/api/system/cluster_config/java.io.File \
    -H "Content-Type: application/json" \
    -H "X-Requested-By: poc" \
    -d '"/etc/passwd"'

To perform the request, authorization is required. Only users posessing the clusterconfigentry:create and clusterconfigentry:edit permissions are allowed to do so. These permissions are usually only granted to Admin users.

Impact

If a user with the appropriate permissions performs the request, arbitrary classes with 1-arg String constructors can be instantiated.

This will execute arbitrary code that is run during class instantiation.

In the specific use case of java.io.File, the behaviour of the internal web-server stack will lead to information exposure by including the entire file content in the response to the REST request.

Credits

Analysis provided by Fabian Yamaguchi - Whirly Labs (Pty) Ltd

Affected versions

Maven

Package	Vulnerable	Fixed in
org.graylog2:graylog2-server	`>= 2.0.0, < 5.1.11`	`5.1.11`
org.graylog2:graylog2-server	`>= 5.2.0-alpha.1, < 5.2.4`	`5.2.4`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

org.graylog2:graylog2-server Maven → `5.1.11`

maven

<dependency><groupId>org.graylog2</groupId><artifactId>graylog2-server</artifactId><version>5.1.11</version></dependency>

gradle

implementation("org.graylog2:graylog2-server:5.1.11")

Severity breakdown

CVSS 3.1 8.8

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack vector: Network
Attack complexity: Low
Privileges required: Low
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

Weakness

CWE-284: Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

How to prevent it

Architecture and Design, Operation: Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
Architecture and Design: Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

References

Advisories

nvd.nist.gov/vuln/detail/CVE-2024-24824

Packages

github.com/Graylog2/graylog2-server

Timeline

Feb 7, 2024 Published
Sep 10, 2026 Last updated by the source
Oct 31, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-m9c2-85gv-8xr5 Graylog: Manager-to-Owner privilege escalation on saved searches and dashboards	Medium	Also affects org.graylog2:graylog2-server
GHSA-j769-9gv9-65gr Graylog token revocation endpoint allows authenticated users to delete other users’ access tokens	Medium	Also affects org.graylog2:graylog2-server
GHSA-gqr6-r77p-c2pj Fortigate syslog message parser can be exploited to modify or delete fields from the original message	High	Also affects org.graylog2:graylog2-server
GHSA-q79r-r9xg-r863 Graylog Server: System Catalog titles endpoint can be used to retrieve values of protected database fields	Medium	Also affects org.graylog2:graylog2-server
GHSA-3m86-c9x3-vwm9 Graylog vulnerable to privilege escalation through API tokens	High	Also affects org.graylog2:graylog2-server
GHSA-76vf-mpmx-777j Graylog Allows Session Takeover via Insufficient HTML Sanitization	Medium	Also affects org.graylog2:graylog2-server
GHSA-q9q2-3ppx-mwqf Graylog Allows Stored Cross-Site Scripting via Files Plugin and API Browser	High	Also affects org.graylog2:graylog2-server
GHSA-q7g5-jq6p-6wvx Graylog's Authenticated HTTP inputs ingest message even if Authorization header is missing or has wrong value	Medium	Also affects org.graylog2:graylog2-server

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor