CVE-2018-11651

Vulnerability

Graylog versions before v2.4.4 are affected by a stored cross-site scripting (XSS) vulnerability in dashboard name fields. The issue originates from unescaped text in dashboard names handled by components Dashboard.jsx, EditDashboardModal.jsx, and ShowDashboardPage.jsx [1][2]. An attacker with the ability to create or edit dashboards can inject arbitrary HTML or JavaScript into the dashboard title; this payload is then rendered without proper sanitization when any user views the dashboard listing or the dashboard page itself.

Exploitation

The attacker must have a valid Graylog account with sufficient privileges to create or edit dashboards (typically an "Admin" or "Manager" role). The attacker crafts a malicious dashboard name containing a JavaScript payload (e.g., ``). Once the dashboard is saved, any user who navigates to the affected dashboard or the dashboard list triggers execution of the injected script in their browser, with no additional user interaction required beyond viewing the page [1].

Impact

Successful exploitation leads to client-side execution of arbitrary JavaScript in the context of the victim's Graylog session. An attacker can steal session cookies, perform actions on behalf of the victim within the application (such as modifying dashboards or extracting search results), and potentially pivot to internal network resources if the victim's browser can access internal services [1]. The impact is limited by the same-origin policy within the Graylog application but can compromise the confidentiality and integrity of log data accessible to the victim.

Mitigation

The vulnerability is fixed in Graylog v2.4.4, released on or around June 1, 2018 [1][4]. The fix processes dashboard titles and descriptions through React and Reflux instead of using jQuery's .html(), which avoids direct injection of unescaped content [3]. Users are strongly advised to upgrade to v2.4.4 or later. No workarounds are documented; blocking dashboard creation is not practical. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog as of this writing.