Skip to content
Fencer Vulns
high 8.8

CVE-2024-24824 in the critical feed json

graylog2-server vulnerable to instantiation of arbitrary classes triggered by API request

published 2024-02-07 2 y ago modified 2026-09-10 1 mo ago also GHSA-p6gg-5hf4-4rgj , EUVD-2024-0682

cvss
8.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
34.7%
EPSS 34.7% chance of exploitation in 30 days, percentile 98%
public exploits
0
none known

Summary

Graylog is a free and open log management platform. Starting in version 2.0.0 and prior to versions 5.1.11 and 5.2.4, arbitrary classes can be loaded and instantiated using a HTTP PUT request to the `/api/system/cluster_config/` endpoint. Graylog's cluster config system uses fully qualified class names as config keys. To validate the existence of the requested class before using them, Graylog loads the class using the class loader. If a user with the appropriate permissions performs the request, arbitrary classes with 1-arg String constructors can be instantiated. This will execute arbitrary code that is run during class instantiation. In the specific use case of `java.io.File`, the behavior of the internal web-server stack will lead to information exposure by including the entire file content in the response to the REST request. Versions 5.1.11 and 5.2.4 contain a fix for this issue.

Patch / fix

  • maven org.graylog2:graylog2-server 5.1.11, 5.2.4
  • graylog graylog 5.1.11, 5.2.4

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
partial
Assessed
2 y ago

Exploit prediction

34.74% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/Graylog2/graylog2-server/security/advisories/GHSA-p6gg-5hf4-4rgj referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
GitHub 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
maven org.graylog2:graylog2-server
>=2.0.0, <5.1.11
>=5.2.0-alpha.1, <5.2.4
5.1.11
5.2.4

Affected products

  • Graylog2 graylog2-server

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.