CVE-2024-24824: Graylog RCE Vulnerability

CVE-2024-24824 Overview

CVE-2024-24824 is an access control vulnerability in Graylog, an open-source log management platform. The flaw affects Graylog versions 2.0.0 through 5.1.10 and 5.2.0 through 5.2.3. An authenticated attacker with sufficient permissions can send an HTTP PUT request to the /api/system/cluster_config/ endpoint to load and instantiate arbitrary Java classes. Classes with single-argument String constructors execute their constructor logic on instantiation. When java.io.File is targeted, the internal web-server stack returns full file contents in the response, exposing sensitive host data. The issue is fixed in versions 5.1.11 and 5.2.4.

Critical Impact

Authenticated attackers can trigger arbitrary code execution and read arbitrary files from the Graylog server host through the cluster config REST API.

Affected Products

• Graylog versions 2.0.0 through 5.1.10
• Graylog versions 5.2.0 through 5.2.3
• graylog2-server component (ClusterConfigResource)

Discovery Timeline

• 2024-02-07 - CVE-2024-24824 published to NVD
• 2024-02-07 - Graylog releases fixed versions 5.1.11 and 5.2.4 with commits 75ef2b8d and 7f8ef7fa
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-24824

Vulnerability Analysis

Graylog's cluster configuration subsystem uses fully qualified Java class names as configuration keys. When a client submits a PUT request to /api/system/cluster_config/{class}, the server validates the target by loading the named class through the class loader. Class loading in this code path invokes the class constructor when a matching single-argument String constructor is available. The endpoint therefore doubles as an arbitrary class instantiation primitive. The vulnerability is tracked under CWE-284 (Improper Access Control) and CWE-863 (Incorrect Authorization). An EPSS score of 34.498% places this CVE in the 98th percentile for exploitation likelihood, and a public proof-of-concept is available.

Root Cause

The ClusterConfigResource handler treats the class name path parameter as trusted input and passes it directly to the JVM class loader without an allowlist. Any class reachable on the Graylog classpath that exposes a public String-argument constructor becomes an attacker-controlled instantiation target. Instantiating java.io.File with an attacker-supplied path causes the Jersey web-server serializer to include the file contents in the JSON response.

Attack Vector

An attacker authenticated to Graylog with permission to modify cluster configuration sends a PUT request to /api/system/cluster_config/java.io.File with a JSON body containing a target file path. The server instantiates the class, and the response body returns the file contents. Substituting other classes with side-effect-bearing constructors yields code execution. A public exploit is published at the rootkiTED PoC repository.

// Vulnerable code path in ClusterConfigResource.java (pre-patch)
// Source: https://github.com/Graylog2/graylog2-server/blob/e458db8bf4f789d4d19f1b37f0263f910c8d036c/graylog2-server/src/main/java/org/graylog2/rest/resources/system/ClusterConfigResource.java#L208-L214
// The class name from the URL path is loaded via the class loader without
// an allowlist, permitting instantiation of arbitrary classes such as java.io.File.

Detection Methods for CVE-2024-24824

Indicators of Compromise

• HTTP PUT requests to /api/system/cluster_config/ where the trailing path segment references classes outside expected Graylog config classes, such as java.io.File, java.net.URL, or java.util.Scanner.
• Graylog API responses that return unexpectedly large payloads or file-like content from cluster config endpoints.
• Authentication events from cluster-config-privileged users originating from unusual source addresses immediately preceding config API calls.

Detection Strategies

• Inspect Graylog access logs for PUT verbs against /api/system/cluster_config/* and alert when the class name is not on an allowlist of legitimate Graylog config classes.
• Correlate REST API access with the requesting user's role to identify accounts abusing cluster configuration privileges.
• Compare installed Graylog version against fixed releases 5.1.11 and 5.2.4 during vulnerability scans.

Monitoring Recommendations

• Forward Graylog server access and audit logs to a centralized SIEM for retention and correlation.
• Baseline normal cluster config API activity and alert on deviations in request volume, source IPs, or class names referenced.
• Monitor outbound connections and process behavior from the JVM running Graylog for signs of post-exploitation activity.

How to Mitigate CVE-2024-24824

Immediate Actions Required

• Upgrade Graylog to version 5.1.11, 5.2.4, or later on all nodes.
• Audit user accounts with cluster configuration permissions and revoke access from unnecessary roles.
• Review Graylog audit logs for prior PUT requests to /api/system/cluster_config/ referencing non-Graylog classes.

Patch Information

Graylog addressed the issue in commits 75ef2b8d and 7f8ef7fa, which introduce a SafeClassesValidator that restricts the classes allowed for cluster config and event types. Full details are in the GHSA-p6gg-5hf4-4rgj advisory.

// Patch introduces SafeClassesValidator to restrict allowed classes
// Source: https://github.com/Graylog2/graylog2-server/commit/75ef2b8d60e7d67f859b79fe712c8ae7b2e861d8
 import com.github.joschi.jadconfig.converters.StringListConverter;
+import com.github.joschi.jadconfig.converters.StringSetConverter;
 import com.github.joschi.jadconfig.validators.PositiveIntegerValidator;
 import com.github.joschi.jadconfig.validators.StringNotBlankValidator;
 import com.github.joschi.jadconfig.validators.URIAbsoluteValidator;
 import org.graylog.datanode.configuration.BaseConfiguration;
+import org.graylog2.Configuration.SafeClassesValidator;
 import org.graylog2.plugin.Tools;

Workarounds

• Restrict network access to the Graylog REST API so that only trusted administrative networks can reach /api/system/cluster_config/.
• Enforce least privilege on Graylog roles and remove cluster configuration rights from non-administrative accounts.
• Place a reverse proxy or WAF in front of Graylog to block PUT requests to /api/system/cluster_config/ referencing non-allowlisted class names until patching is complete.

# Example nginx rule to block requests referencing java.io.File on the cluster config endpoint
location ~ ^/api/system/cluster_config/ {
    if ($request_method = PUT) {
        if ($request_uri ~* "cluster_config/(java\.|javax\.|sun\.|com\.sun\.)") {
            return 403;
        }
    }
    proxy_pass http://graylog_backend;
}