GHSA-q79r-r9xg-r863: Medium severity maven/org.graylog2:graylog2-server vulnerability
Impact
A vulnerability was found in Graylog's API endpoint for retrieving system catalog entity titles. Authenticated users could retrieve database fields of supported entities by sending a custom API request. These fields can include e.g. the password hash of a user (but not the password itself), which should not be returned through the API, regardless of the endpoint. Permission checks do still apply, so users can retrieve their own password hash, but not those of other users. The admin user (or any user with an admin role) can retrieve password hashes of all users.
Patches
This issue has been patched in Graylog 7.1.4. In this version, an allow list will be used to check if protected fields are being accessed, refusing those requests. Affected users should upgrade to 7.1.4 or above to remediate the vulnerability.
Workarounds
There is no known workaround. Upgrading to a patched version is recommended.
Credits
Thanks to Evelynkaz for reporting.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.graylog2:graylog2-serverto a version that resolves this vulnerability.Fixed in 7.1.4 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 7.1.4
Event History
Frequently Asked Questions
Who can exploit this issue, and what access do they need?
An attacker must be authenticated to Graylog and able to send a custom request to the API endpoint that retrieves system catalog entity titles. Permission checks still apply, so non-administrative users can retrieve fields only for entities they are permitted to access.
What sensitive information may be exposed?
Supported entity database fields may be returned through the API, including a user's password hash. Passwords themselves are not exposed through this issue.
Are administrator accounts at greater risk?
Yes. The admin user and users with an admin role can retrieve password hashes for all users, while other users cannot retrieve password hashes belonging to other users.
What version fixes the issue, and is there a workaround?
Graylog 7.1.4 adds an allow list that rejects requests for protected fields. There is no known workaround; upgrade to version 7.1.4 or later.