PT-2024-20589 · Graylog · Graylog
Fabian Yamaguchi
+1
·
Published
2024-02-07
·
Updated
2024-02-15
·
CVE-2024-24823
CVSS v3.1
5.7
Medium
| Vector | AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
Graylog versions 4.3.0 through 5.1.10
Graylog versions 4.3.0 through 5.2.3
Description
The issue allows reauthenticating with an existing session cookie to re-use that session id, even if for different user credentials. This could be used to gain elevated access to an existing Graylog login session, provided the malicious user could successfully inject their session cookie into someone else's browser. The complexity of such an attack is high, because it requires presenting a spoofed login screen and injection of a session cookie into an existing browser, potentially through a cross-site scripting attack. No such attack has been discovered. Using short session expiration and explicit log outs of unused sessions can help limiting the attack vector. A proxy could be leveraged to clear the
authentication cookie for the Graylog server URL for the "/api/system/sessions" endpoint, as that is the only one vulnerable.Recommendations
For Graylog versions 4.3.0 through 5.1.10, update to version 5.1.11 or later to resolve the issue.
For Graylog versions 4.3.0 through 5.2.3, update to version 5.2.4 or later to resolve the issue.
As a temporary workaround, consider using short session expiration and explicit log outs of unused sessions to limit the attack vector.
Restrict access to the "/api/system/sessions" endpoint by clearing the
authentication cookie for the Graylog server URL using a proxy.Exploit
Fix
Session Fixation
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Graylog