Miggo Logo
Miggo Vulnerability Database
→
CVE-2023-41045

CVE-2023-41045:
Graylog vulnerable to insecure source port usage for DNS queries

3.7

CVSS Score
3.1

Basic Information

CVE ID
CVE-2023-41045
GHSA ID
GHSA-g96c-x7rh-99r3
EPSS Score
0.34079%
CWE
CWE-345
Published
7/6/2023
Updated
11/6/2023
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
org.graylog2:graylog2-servermaven>= 5.1.0, < 5.1.35.1.3
org.graylog2:graylog2-servermaven< 5.0.95.0.9

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from Graylog's DNS client using a single socket with a fixed source port. The pre-patch DnsClient:

  1. In start(), created a single DnsNameResolver via DnsNameResolverBuilder without port randomization
  2. Maintained persistent resolver instance via 'resolver' field
  3. Lacked pooling logic present in the patched version (DnsResolverPool)

The patch introduced pool management (DnsResolverPool.takeLease()) and removed the single-resolver initialization. The original start() method's single-resolver initialization directly caused the predictable source port behavior shown in the PoC graph. The constructor's inability to accept pool parameters enforced this insecure design.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Summ*ry *r*ylo* utilis*s only on* sin*l* sour** port *or *NS qu*ri*s. ### **t*ils *r*ylo* s**ms to *in* * sin*l* so*k*t *or out*oin* *NS qu*ri*s. T**t so*k*t is *oun* to * r*n*om port num**r w*i** is not ***n*** ***in. T*is *o*s ***inst r**omm*n

Reasoning

T** vuln*r**ility st*ms *rom *r*ylo*'s *NS *li*nt usin* * sin*l* so*k*t wit* * *ix** sour** port. T** pr*-p*t** *ns*li*nt: *. In st*rt(), *r**t** * sin*l* *nsN*m*R*solv*r vi* *nsN*m*R*solv*r*uil**r wit*out port r*n*omiz*tion *. M*int*in** p*rsist*nt