Fluentd vulnerable to remote code execution due to insecure deserialization (in non-default configuration)

Vulnerability

Overview

CVE-2022-39379 is a remote code execution (RCE) vulnerability in Fluentd, an open-source data collector. The flaw resides in the Oj JSON parser when the environment variable FLUENT_OJ_OPTION_MODE is explicitly set to object. In this non-default configuration, the parser deserializes JSON payloads in a mode that can instantiate arbitrary Ruby objects, leading to code execution [1][2].

Exploitation

An unauthenticated attacker can exploit this vulnerability by sending a specially crafted JSON payload to a Fluentd instance that has FLUENT_OJ_OPTION_MODE=object set. The attack does not require authentication and can be delivered over any input source that accepts JSON, such as HTTP or TCP inputs. The vulnerability was introduced in Fluentd version 1.13.2 when the FLUENT_OJ_OPTION_MODE option was added [1].

Impact

Successful exploitation allows an attacker to execute arbitrary code on the host running Fluentd, potentially leading to full compromise of the logging infrastructure and access to sensitive data processed by Fluentd [1].

Mitigation

The issue is patched in Fluentd version 1.15.3. Users are strongly advised to upgrade. As a workaround, do not set FLUENT_OJ_OPTION_MODE=object; the default configuration is not affected [1][2].