Executive Summary

The vulnerability exists in Metrics::Any::Adapter::SignalFx versions before 0.04 for Perl, where it does not protect against metric injections.

The statsd protocol and its extensions, such as dogstatsd, allow multiple metrics to be sent in a single packet separated by newlines.

Metrics::Any::Adapter::SignalFx extends Metrics::Any::Adapter::Statsd, which has a similar vulnerability.

Specifically, the _labels function does not check for newlines or control characters in tag labels, which can be exploited to inject additional metrics.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker to perform metric injections by exploiting the lack of validation in tag labels.

By injecting malicious metrics, an attacker could potentially manipulate monitoring data, leading to inaccurate or misleading metrics.

This could affect system monitoring, alerting, and decision-making processes that rely on accurate metric data.

Useful 0 Not Useful 0