Filebeat Buffer Overflow Exploit

Filebeat is a logging and monitoring tool used by Elastic to collect and process log data. This vulnerability allows an attacker to trigger a buffer overflow in the Filebeat Syslog parser and Libbeat Dissect processor, causing a denial of service (panic/crash) of the Filebeat process via either a malformed Syslog message or a malicious tokenizer pattern in the Dispect configuration.

Filebeat 7.x: All versions
Filebeat 8.x: Versions 8.0.0 to 8.19.8 are affected; version 8.19.9 is fixed.
Check with: filebeat -v --config.file=/etc/filebeat/filebeat.yml (run this command on the Filebeat server)

Note: This vulnerability does not affect similar products like Logstash or Kibana.

1. Upgrade to Filebeat 8.19.9, 9.1.9, or 9.2.3 from the official Elastic website.
2. Immediate mitigations:
3. Restrict network access to your Filebeat instance (firewall it from the public internet)
4. Audit admin account activity for suspicious access patterns
5. Monitor for unauthorized token creation

• Vendor Advisory