graylog-default-login: Graylog - Default Login

id: graylog-default-login

info:
  name: Graylog - Default Login
  author: PentesterTN
  severity: high
  description: |
    Graylog instance is accessible with default admin credentials (admin/admin). This provides full administrative access to the log management platform, including the ability to read all ingested logs, create inputs, configure pipelines, and manage users.
  impact: |
    An attacker with admin access to Graylog can read all collected log data which may contain credentials, API keys, internal IPs, and sensitive business information. They can also create new inputs to intercept future log data or modify pipelines to redirect/suppress logs.
  remediation: |
    Change the default root_password_sha2 in the Graylog server.conf configuration file. Use a strong, unique password for the admin account.
  reference:
    - https://docs.graylog.org/docs/server-conf
    - https://docs.graylog.org/docs/authentication
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
    cvss-score: 9.1
    cwe-id: CWE-798
  metadata:
    verified: true
    max-request: 2
    shodan-query: title:"Graylog"
  tags: default-login,graylog,logging

http:
  - raw:
      - |
        POST /api/system/sessions HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json
        Accept: application/json
        X-Requested-By: nuclei

        {"username":"admin","password":"admin","host":"{{Hostname}}"}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"session_id"'
          - '"valid_until"'
        condition: and

      - type: status
        status:
          - 200
# digest: 4b0a00483046022100863d2900e9cd4e7837e54f808e7fc891351edcde093ffb1e0f3d28e44cdd12eb022100fc83ce2073fbbf50e0aa0305c993fa16d2a2344c70b99372a8f22d2284832b36:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.