CVE-2018-11650

Vulnerability

Graylog versions before 2.4.4 are vulnerable to a cross-site scripting (XSS) issue in notifications. The vulnerability resides in the util/UserNotification.js module, which uses the toastr library to display notifications. User-supplied text is not properly escaped before being inserted into the DOM, allowing an attacker to inject arbitrary HTML and JavaScript [1][2].

Exploitation

To exploit this vulnerability, an attacker must be able to control the text content of a notification, for example by supplying malicious input that is later reflected in a toast notification. The victim must view the notification in their browser. No special network position or authentication is required beyond the ability to trigger a notification with crafted text [1][2].

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the Graylog web interface, potentially leading to session hijacking, data theft, or other malicious actions on behalf of the victim [2].

Mitigation

Graylog has addressed this vulnerability in version 2.4.4, released on May 23, 2018 [4]. Users should upgrade to v2.4.4 or later. No workarounds are documented; upgrading is the recommended action [1][4].