ReDoS vulnerability in parser_apache2

Vulnerability

The parser_apache2 plugin in Fluentd versions 0.14.14 to 1.14.1 contains a regular expression denial of service (ReDoS) vulnerability [1][2]. The flaw exists in the regular expression used to parse Apache log entries. An attacker can craft a malformed log line with a specific pattern that causes the regex engine to exhibit catastrophic backtracking, resulting in excessive CPU consumption [1]. This affects all deployments using parser_apache2 to parse logs that cannot be guaranteed to originate from a legitimate Apache instance [1].

Exploitation

An attacker does not require authentication or special network position if they can inject log lines into a source that Fluentd processes using parser_apache2 [1]. The attacker must send a log line with a carefully constructed pattern that triggers exponential backtracking in the vulnerable regex [1]. No user interaction beyond normal log processing is needed; the attack manifests during the parsing step [1].

Impact

Successful exploitation leads to prolonged CPU usage by the Fluentd process, potentially causing a denial of service (DoS) condition where log processing stalls or the system becomes unresponsive [1]. The impact is strictly availability; no data confidentiality or integrity is compromised [1].

Mitigation

The vulnerability is patched in Fluentd version 1.14.2 [1][3]. As a workaround, administrators can either avoid using parser_apache2 for logs that may originate from untrusted sources, or manually place a patched version of parser_apache2.rb into the plugin directory (e.g., /etc/fluent/plugin or a directory specified by the FLUENT_PLUGIN environment variable or --plugin option) [1].