Summary
A path traversal vulnerability can occur in rsyslog when the omfile dynaFile facility uses untrusted values to construct output paths without secure-path handling. An attacker who can influence such a value may cause logs to be written outside the intended directory, potentially overwriting or creating files where the rsyslog process has permission.
A path traversal vulnerability can occur in rsyslog when the omfile dynaFile facility uses untrusted values to construct output paths without secure-path handling. An attacker who can influence such a value may cause logs to be written outside the intended directory, potentially overwriting or creating files where the rsyslog process has permission.
Affected context
The issue affects rsyslog deployments that use omfile with dynaFile templates to generate dynamic output paths. The deployment becomes risky when a value influenced by untrusted input is incorporated into a path component without canonicalization, containment checks, or another secure-path control. This condition is not limited to the RFC5424 HOSTNAME field; any untrusted value reaching the template may create the exposure.
The issue affects rsyslog deployments that use omfile with dynaFile templates to generate dynamic output paths. The deployment becomes risky when a value influenced by untrusted input is incorporated into a path component without canonicalization, containment checks, or another secure-path control. This condition is not limited to the RFC5424 HOSTNAME field; any untrusted value reaching the template may create the exposure.
Exploit preconditions
- Attack surface: rsyslog log-processing and dynamic file-output configuration
- Required access: Ability to influence a value consumed by an omfile dynaFile template
- Trigger point: Rendering the dynamic output path while processing a matching log message
- Why exploitation is possible: The generated path may not remain within the intended log directory when untrusted path components are accepted without secure containment checks
- Attack surface: rsyslog log-processing and dynamic file-output configuration
- Required access: Ability to influence a value consumed by an omfile dynaFile template
- Trigger point: Rendering the dynamic output path while processing a matching log message
- Why exploitation is possible: The generated path may not remain within the intended log directory when untrusted path components are accepted without secure containment checks
Why this happens
The underlying bug class is external control of a file name or path, mapped primarily to CWE-73, together with path traversal, mapped to CWE-22. A dynaFile template is intentionally flexible, but treating attacker-influenced data as a trusted path component can allow directory-boundary assumptions to be bypassed. The insecure pattern is constructing filesystem paths from untrusted values without restricting the resulting path to an approved directory.
The underlying bug class is external control of a file name or path, mapped primarily to CWE-73, together with path traversal, mapped to CWE-22. A dynaFile template is intentionally flexible, but treating attacker-influenced data as a trusted path component can allow directory-boundary assumptions to be bypassed. The insecure pattern is constructing filesystem paths from untrusted values without restricting the resulting path to an approved directory.
Potential impact
- Log data may be written outside the intended directory
- Existing files could be overwritten if the rsyslog process has sufficient permissions
- Sensitive locations may receive attacker-influenced content
- Filesystem integrity or service availability could be affected
- The issue could support further compromise when privileged paths are writable
- Log data may be written outside the intended directory
- Existing files could be overwritten if the rsyslog process has sufficient permissions
- Sensitive locations may receive attacker-influenced content
- Filesystem integrity or service availability could be affected
- The issue could support further compromise when privileged paths are writable
General mitigation guidance
Mitigation generally focuses on reducing trust in values used by dynamic file templates and enforcing filesystem containment.
Common defensive patterns include:
- Restricting dynaFile path components to approved, non-user-controlled values
- Canonicalizing and validating the final path before opening the file
- Enforcing that resolved paths remain below an explicitly configured log directory
- Rejecting traversal markers, absolute paths, unexpected separators, and other invalid path forms as defense-in-depth
- Using fixed output paths or controlled identifiers instead of raw message-derived values
- Running rsyslog with the minimum filesystem permissions required for log collection
- Applying filesystem isolation, dedicated log partitions, and restrictive ownership policies where practical
- Treating dynamic path templates as security-sensitive configuration during deployment review
Mitigation generally focuses on reducing trust in values used by dynamic file templates and enforcing filesystem containment.
Common defensive patterns include:
- Restricting dynaFile path components to approved, non-user-controlled values
- Canonicalizing and validating the final path before opening the file
- Enforcing that resolved paths remain below an explicitly configured log directory
- Rejecting traversal markers, absolute paths, unexpected separators, and other invalid path forms as defense-in-depth
- Using fixed output paths or controlled identifiers instead of raw message-derived values
- Running rsyslog with the minimum filesystem permissions required for log collection
- Applying filesystem isolation, dedicated log partitions, and restrictive ownership policies where practical
- Treating dynamic path templates as security-sensitive configuration during deployment review
How teams detect issues like this
Detection can combine configuration analysis, code review, and runtime monitoring:
- Search configuration repositories for omfile dynaFile templates containing message fields or other externally influenced values
- Review whether every dynamic path component is constrained to an approved identifier set
- Use static or policy analysis to flag filesystem paths assembled from untrusted log properties
- Test path canonicalization and directory-containment behavior with security-focused configuration tests
- Monitor rsyslog file-open activity for writes outside approved log directories
- Alert on unexpected creation or modification of sensitive files by the rsyslog service account
- Automated configuration review tools can help enforce approved dynamic-path patterns in CI and deployment pipelines
Detection can combine configuration analysis, code review, and runtime monitoring:
- Search configuration repositories for omfile dynaFile templates containing message fields or other externally influenced values
- Review whether every dynamic path component is constrained to an approved identifier set
- Use static or policy analysis to flag filesystem paths assembled from untrusted log properties
- Test path canonicalization and directory-containment behavior with security-focused configuration tests
- Monitor rsyslog file-open activity for writes outside approved log directories
- Alert on unexpected creation or modification of sensitive files by the rsyslog service account
- Automated configuration review tools can help enforce approved dynamic-path patterns in CI and deployment pipelines
Sources
| Source | Link |
|---|---|
| github. | github.com/ |
