A vulnerability (CVE-2024-4323) has been identified in the open-source project Fluent Bit, allowing for remote memory corruption that can be exploited to cause denial of service, data leakage, and potentially execute arbitrary code on the server. The problem, code-named "Linguistic Lumberjack," is rated at a critical severity level (9.8 out of 10). The vulnerability manifests starting from version 2.0.7 and has been resolved in the patch updates 2.2.3 and 3.0.4.
Fluent Bit has over 10 billion deployments and is used for processing and collecting logs and metrics across many companies and cloud platforms, including notable users such as Google Cloud, AWS, DigitalOcean, vmWare, Cisco, Microsoft, Lyft, LinkedIn, Walmart, Couchbase, Swift, and Dell. In March alone, 13 million Docker images of Fluent Bit were downloaded. According to Tenable, the company that uncovered the vulnerabilities, many cloud services do not block access to Web APIs for retrieving internal metrics, like uptime, and Fluent Bit is used to process requests to such APIs.
The vulnerability is caused by an error in the embedded HTTP server that occurs during the handling of external requests via API calls "/api/v1/traces" and "/api/v1/trace", which allow users to access information about configured traces. Regardless of whether tracing is enabled, a user can access the API data if granted the appropriate access. During the parsing of incoming requests, the types of some input fields transmitted through an array in the JSON block were determined incorrectly and were interpreted as type MSGPACK_OBJECT_STR, regardless of the expected field type. Specifying non-string values, such as integer parameters, in the input array led to memory corruption because the function flb_sds_create_len() extracted the passed integer value as a field with string length.
An example of a request that triggers a crash: python3 -c ‘print("{\"output\":\"stdout\", \"params\": {\"format\": \"json\"},\"inputs\":[\"" + "A"*8 + "\"," + str(0xffffffff) + ", \"" + "B"*500 + "\"]}")’ > test curl -v http://:2020/api/v1/traces/ -H "Content-Type: application/json" -H "Expect: " --data "@test"
During the experiments, researchers managed to force the service to crash and identify the residual contents of memory used while processing HTTP requests, which contained, for example, fragments of sensitive data like access keys. Since the issue leads to a buffer overflow dependent on the transmitted parameters, it could theoretically be exploited to execute code within the system, but the researchers who identified the problem did not test this possibility due to a lack of time to work on an exploit.
Source: opennet.ru
