CVE-2024-4323

The bug lies in the trace request parsing mechanism of Fluent Bit's built-in HTTP server. Improper input data processing leads to memory corruption (memory corruption) in the heap area (heap), which is classified as a heap buffer overflow. An attacker can send a specially crafted network request to the exposed HTTP server without the need for any privileges or authentication. Depending on the context and payload used, the result may be process crash, memory content leak, or code execution control takeover.

An attacker can remotely execute arbitrary code (RCE) in the context of the Fluent Bit process, gain access to sensitive data processed in the process memory, or completely disable the service (DoS), which in log collection environments may result in loss of visibility of security events.

Fluent Bit should be updated to a version higher than 3.0.3, applying patches available in the vendor's repository (commit 9311b43a258352797af40749ab31a63c32acfd04). If immediate update is not possible, consider disabling the built-in HTTP server or restricting access to it at the firewall level to trusted hosts only.

Fluent Bit (Treasuredata) versions 2.0.7 to 3.0.3 inclusive, with the built-in HTTP server enabled.