rootkited/graylog-cve-2024-24824-exploitProof-of-concept exploit for CVE-2024-24824 demonstrating how an arbitrary class loading primitive can be transformed into remote code execution on vulnerable Graylog deployments.
This repository contains the proof-of-concept exploit presented in my talk:
Exploiting Arbitrary Class Loading on the JVM
Watch it here if you're interested: Youtube
The exploit targets CVE-2024-24824 (minor typo in the slides), an arbitrary class loading vulnerability affecting Graylog versions 2.0.0 through 5.2.3.
Rather than treating arbitrary class loading as an end goal, this research explores how the primitive can be abused to discover and build increasingly powerful exploitation techniques by analysing the available JVM classpath.
Given the ability to instantiate arbitrary classes with attacker-controlled data, the challenge becomes:
What can we actually do with that?
The answer depends entirely on what classes exist within the target application's classpath.
The accompanying research explored how an arbitrary class loading primitive could be transformed into multiple exploitation primitives, including:
This repository focuses on the remote code execution exploit demonstrated during the talk.
Below is the expected result of running the exploit on a vulnerable instance:
exploit/
exploit source
docs/
slides
The accompanying talk walks through the exploitation process from start to finish:
The goal is to demonstrate the thought process behind exploit development rather than simply dropping an exploit.
This code is released for educational purposes, security research, and authorized security testing only.
Only test systems that you own or have explicit permission to assess.