Uploaded image for project: 'Network Observability'
  1. Network Observability
  2. NETOBSERV-133

UI: Prevent LogQL and HTTP Query params injection in Netflow table filter

Details

    • Bug
    • Resolution: Done
    • Major
    • None
    • None
    • Console Plugin, Loki
    • NetObserv - Sprint 213, NetObserv - Sprint 214

    Description

      Introducing just a double-quote " character in the filters table would cause the table to visualize a 503 error message.

      In addition, its possible to inject LogQL commands as well as HTTP query parameters from the Network Traffic table.

      As a vulnerability example, try to e.g. select the `Src Pod` label in the table filter and then place one of the following lines in the input text (including the quotes):

      "|json|DstAddr=ip("172.0.0.0/8")|~"
      "&limit=1000&foo="bar

      Attachments

        Activity

          People

            ocazade@redhat.com Olivier Cazade
            mmaciasl@redhat.com Mario Macias (Inactive)
            Jean Chen Jean Chen
            Votes:
            0 Vote for this issue
            Watchers:
            5 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: