CVE-2024-24823 graylog2-server Session Fixation vulnerability through cookie injection

What is CVE-2024-24823?

CVE-2024-24823 is a medium-severity authentication bypass vulnerability in graylog2-server, published on 7 Feb 2024. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.

Official description

Graylog is a free and open log management platform. Starting in version 4.3.0 and prior to versions 5.1.11 and 5.2.4, reauthenticating with an existing session cookie would re-use that session id, even if for different user credentials. In this case, the pre-existing session could be used to gain elevated access to an existing Graylog login session, provided the malicious user could successfully inject their session cookie into someone else's browser. The complexity of such an attack is high, because it requires presenting a spoofed login screen and injection of a session cookie into an existing browser, potentially through a cross-site scripting attack. No such attack has been discovered. Graylog 5.1.11 and 5.2.4, and any versions of the 6.0 development branch, contain patches to not re-use sessions under any circumstances. Some workarounds are available. Using short session expiration and explicit log outs of unused sessions can help limiting the attack vector. Unpatched this vulnerability exists, but is relatively hard to exploit. A proxy could be leveraged to clear the `authentication` cookie for the Graylog server URL for the `/api/system/sessions` endpoint, as that is the only one vulnerable.

Weakness: CWE-384

Which versions are affected by CVE-2024-24823?

4 open source packages ship an affected version, including org.graylog2:graylog2-server. It affects 1 product.

Products include Graylog Graylog.

How do I fix CVE-2024-24823?

Upgrade org.graylog2:graylog2-server to a fixed version for your release line: 5.1.11 or 5.2.4.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2024-24823 being exploited?

There is no known exploitation of CVE-2024-24823 in the wild and no public exploit code.

Other vulnerabilities in graylog2-server

• CVE-2021-37759 Information disclosure in n/a Critical 9.8
• CVE-2021-37760 Information disclosure in n/a Critical 9.8
• CVE-2026-1435 Incorrect management of session invalidation vulnerability in Graylog Web Interface Critical 9.3
• CVE-2025-53106 Graylog vulnerable to privilege escalation through API tokens High 8.8
• CVE-2024-24824 graylog2-server vulnerable to instantiation of arbitrary classes triggered by API request High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-3xf8-g8gr-g7rh.