Path traversal in Fluentd - #VU152738

Vulnerability details

The vulnerability allows a remote attacker to write arbitrary files or overwrite existing files with attacker-controlled content.

The vulnerability exists due to improper limitation of a pathname to a restricted directory in output plugin file path template validation when substituting an untrusted bare `..` tag into a configured path template. A remote attacker can provide a bare `..` tag value to bypass directory restrictions and write arbitrary files or overwrite existing files with attacker-controlled content.

The secondary post-substitution validation is skipped when the buffer is configured to group by tag only.

Affected software

Remediation

External References

• https://github.com/fluent/fluentd/security/advisories/GHSA-5hq3-r276-rfr5

Related Security Bulletins

• Multiple vulnerabilities in Fluentd