GHSA-j769-9gv9-65gr: Maven/org.graylog2:graylog2-server vulnerability
Impact
Graylog contains an insecure direct object reference (IDOR) vulnerability in the token revocation endpoint. An authenticated user can delete access tokens belonging to other users, including service account tokens and administrator tokens, if they know or can guess a valid token identifier.
The issue does not expose token contents, but it allows unauthorized token deletion, leading to integrity impact and potential availability impact for access token based integrations.
Patches
The issue has been fixed in the following Graylog versions: 6.3.12, 7.0.7, 7.1.2. Users should upgrade to one of these versions or above to remediate the vulnerability.
Graylog Cloud has already been patched.
Workarounds
There are no feasible workarounds for this issue. Upgrading to a patched version is recommended.
Customers using Graylog Enterprise or Security can review the audit log[^1] for suspicious activity. Audit log lines for successful token deletions begin with access token deleted from user.
Credits
Thanks to michaelddickenson and sreelim for reporting.
[^1]: https://go2docs.graylog.org/current/interactingwithyourlogdata/auditlog.html
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.graylog2:graylog2-serverto a version that resolves this vulnerability.Fixed in 7.1.2 - Upgrade
Upgrade
maven/org.graylog2:graylog2-serverto a version that resolves this vulnerability.Fixed in 7.0.7 - Upgrade
Upgrade
maven/org.graylog2:graylog2-serverto a version that resolves this vulnerability.Fixed in 6.3.12 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.3.12 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 7.0.7 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 7.1.2 - Compensating control
Audit Graylog audit log lines for successful token deletions; suspicious activity is indicated by log lines that begin with `access token deleted from user`.
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker must be authenticated and know or successfully guess a valid access-token identifier. They can then delete tokens belonging to other users, including service-account and administrator tokens.
What is the operational impact of a successful attack?
Token contents are not exposed. However, unauthorized deletion can disrupt access-token-based integrations and creates integrity and potential availability impact.
Which deployments are already patched?
Graylog Cloud has already been patched. For self-managed deployments, the fix is available in Graylog 6.3.12, 7.0.7, and 7.1.2 and later versions.
What can be done if an upgrade cannot happen immediately?
No feasible workaround is available. Upgrade to a patched version as soon as possible.
How can Enterprise or Security customers investigate possible exploitation?
Review the audit log for suspicious successful token deletions. Relevant audit-log entries begin with "access token deleted from user".