REST API missing protection - security issue

[cmeury]

I am not sure how this is happening but I wanted to quickly drop a note here, better sooner than later with these things.
The end-point https://example.org:12900/system/cluster/node is accessible without authorization and exposes details like node id, internal IP, internal hostname. What's going on here?

[bernd]

The endpoint is currently used by the web interface to check if a server is available. This is done before the user is logged in. We will change this to use an endpoint that does not expose that much information in Graylog 2.2 and protect the /cluster/node and /cluster/nodes endpoints to only be accessible to authenticated users.

Thank you for the report!

[cmeury]

Thanks for picking this up and apologies for the haphazard report, I just wanted to get this out there as quickly as possible.