Arbitrary Class Loading Vulnerability in Graylog's Cluster Config System
CVE-2024-24824

8.8HIGH

Key Information:

Vendor: Graylog2
Status: Graylog2-server
Vendor: CVE Published:; 7 February 2024

What is CVE-2024-24824?

Graylog, a widely used open-source log management platform, is susceptible to a vulnerability that enables the loading and instantiation of arbitrary classes. This issue arises from the handling of HTTP PUT requests to the /api/system/cluster_config/ endpoint, where the system permits the submission of fully qualified class names as configuration keys. If executed by an authorized user, this vulnerability can lead to code execution during class instantiation, facilitating potential data exposure. Notably, when the java.io.File class is used, the internal web-server's response could inadvertently reveal sensitive file content. Resolutions for this flaw were incorporated in Graylog versions 5.1.11 and 5.2.4.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch