Stolen Graylog Session Token Can Be Used for Unauthorized Access

Summary

A security issue in Graylog Web Interface version 2.2.3 allows an attacker to use a stolen session token to access the application and compromise an account. This could happen if an attacker gains access to the network where Graylog is running or if a user's session token is leaked. To protect against this, users should ensure they log out of Graylog after each use and keep their network secure.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
graylog	graylog	2.2.3	–

Original title

Not properly invalidated session vulnerability in Graylog Web Interface, version 2.2.3, due to incorrect management of session invalidation after new logins. The application generates a new 'sessio...

Original description

Not properly invalidated session vulnerability in Graylog Web Interface, version 2.2.3, due to incorrect management of session invalidation after new logins. The application generates a new 'sessionId' each time a user authenticates, but does not invalidate previously issued session identifiers, which remain valid even after multiple consecutive logins by the same user. As a result, a stolen or leaked 'sessionId' can continue to be used to authenticate valid requests. Exploiting this vulnerability would allow an attacker with access to the web service/API network (port 9000 or HTTP/S endpoint of the server) to reuse an old session token to gain unauthorized access to the application, interact with the API/web, and compromise the integrity of the affected account.

nvd CVSS3.1 9.8

nvd CVSS4.0 9.3

Vulnerability type

CWE-613

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-gray... Third Party Advisory