Executive Summary

This vulnerability occurs in Fluent Bit's in_http, in_splunk, and in_elasticsearch input plugins, which fail to properly sanitize tag_key inputs. An attacker with network access or the ability to write records into Splunk or Elasticsearch can supply tag_key values containing special characters like newlines or ../ sequences. These special characters are treated as valid tags, which can lead to newline injection, path traversal, forged record injection, or log misrouting.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can impact you by compromising data integrity and log routing. Specifically, it can allow attackers to inject newlines, traverse paths, forge records, or cause logs to be misrouted. This can disrupt the normal processing and storage of logs, potentially leading to incorrect or misleading log data and affecting system monitoring and incident response.

Useful 0 Not Useful 0