Critical Bug Allows Data Leaks in All Major Cloud Platforms
An on-by-default endpoint in ubiquitous logging service Fluent Bit contains an oversight that hackers can toy with to rattle most any cloud environment.
Researchers have discovered a severe memory corruption vulnerability inside of a cloud logging utility used across major cloud platforms.
The service, Fluent Bit, is an open source tool for collecting, processing, and forwarding logs and other types of application data. It's one of the more popular pieces of software out there, with more than three billion downloads as of 2022, and a new 10 million or so deployments with each passing day. It's used by major organizations such as VMware, Cisco, Adobe, Walmart, and LinkedIn, and nearly every major cloud service provider, including AWS, Microsoft, and Google Cloud.
The issue with Fluent Bit, dubbed "Linguistic Lumberjack" in a new report from Tenable, lies in how the service's embedded HTTP server parses trace requests. Manipulated in one way or another, it can cause denial of service (DoS), data leakage, or remote code execution (RCE) in a cloud environment.
"Everyone gets hyped about a vulnerability in Azure, AWS, GCP,