Listen to this Post
LogTape is an unobtrusive logging library for JavaScript/TypeScript environments. The `@logtape/syslog` package provides a syslog sink that sends log messages to a syslog server following the RFC 5424 specification. Prior to versions 1.3.11, 2.0.14, and 2.1.5, this package contained two related output-encoding bugs in the structured data formatting code. Both bugs only affect deployments with includeStructuredData: true, which is a non-default configuration option.
The first bug resides in the `escapeStructuredDataValue()` function in packages/syslog/src/syslog.ts. This function escapes backslashes (\), double quotes ("), and closing brackets (]) per RFC 5424, but it does not escape newline (\n), carriage return (\r), or any other C0 control characters (U+0000–U+001F). TCP syslog commonly uses newline (\n) as a frame delimiter, as defined by RFC 6587 (non-transparent framing). If an attacker-controlled log property value contains a literal newline, that newline terminates the current syslog frame. Any bytes following the newline begin a new frame, and if they form a valid RFC 5424 header (starting with <PRI>1 …), a downstream collector will accept them as a separate, authentic-looking syslog record.
The second bug involves unvalidated SD-NAME keys. Structured data parameter keys are inserted into the syslog message without any validation or escaping: elements.push(${key}=”${escapedValue}”). RFC 5424 defines SD-NAME as printable US-ASCII characters, excluding=,],“, and space, with a maximum length of 32 characters. A key containing any forbidden character, control characters, or exceeding the length limit will produce malformed structured data. If the key itself contains an embedded], it can prematurely close the structured-data element.
In typical usage, property keys are developer-defined string literals and therefore safe. However, if an application forwards attacker-controlled keys as log properties—for example by spreading request headers or arbitrary metadata into a log record—this becomes a second injection path. An attacker who controls log property values can forge syslog records attributed to arbitrary hosts, applications, or process IDs; insert records with arbitrary severity or facility levels; obscure malicious activity by injecting misleading entries around legitimate ones; and break downstream log parsers or SIEM correlation rules that rely on log integrity. Affected downstream collectors include rsyslog, syslog-ng, Splunk, Elastic Stack, and any other system using RFC 6587 non-transparent framing.
<h2 style="color: blue;">DailyCVE Form:</h2>
Platform: @logtape/syslog (npm/JSR)
Version: <= 2.1.4
Vulnerability: CRLF Injection (CWE-93)
Severity: High (CVSS 8.6)
Date: 2026-08-26
<h2 style="color: blue;">Prediction: 2026-08-26 (Patched in 1.3.11, 2.0.14, 2.1.5)</h2>
<h2 style="color: blue;">What Undercode Say:</h2>
Check if your @logtape/syslog version is vulnerable npm list @logtape/syslog Vulnerable versions: <= 2.1.4 Fixed versions: 1.3.11, 2.0.14, 2.1.5 Update to a patched version npm install @logtape/[email protected] or for the 1.x branch: npm install @logtape/[email protected] or for the 2.0.x branch: npm install @logtape/[email protected]
Verify the fix - check if C0 control characters are now escaped
The fix replaces C0 control characters with printable NNN sequences
Run the following test in Node.js to confirm the vulnerability is patched:
node -e "const { escapeStructuredDataValue } = require('@logtape/syslog/dist/syslog'); const payload = 'normal\n<134>1 2026-01-01T00:00:00Z forged evil - - - INJECTED'; console.log('Newline present after escape:', escapeStructuredDataValue(payload).includes('\n'));"
Should print: Newline present after escape: false (if patched)
<h2 style="color: blue;">Exploit: (Educational Purposes!)</h2>
The following Node.js snippet demonstrates that the escaped value still contains a literal newline in vulnerable versions:
function escapeStructuredDataValue(value) {
return value
.replace(/\\/g, "\\\\")
.replace(/"/g, '\\"')
.replace(/]/g, "\\]");
}
const payload = 'normal\n<134>1 2026-01-01T00:00:00Z forged evil - - - INJECTED';
const result = escapeStructuredDataValue(payload);
console.log("Newline present after escape:", result.includes("\n")); // true
An attacker who controls log property values can inject a newline followed by a forged RFC 5424 syslog record:
// Attacker-controlled log property const maliciousValue = 'legitimate_log_data\n<134>1 2026-01-01T00:00:00Z attacker host - - - FORGED_RECORD'; // When logged with includeStructuredData: true, the newline terminates the frame // and the forged record is accepted by downstream collectors as authentic
<h2 style="color: blue;">Additionally, unvalidated SD-NAME keys can corrupt structured data:</h2>
// Attacker-controlled key with a closing bracket const maliciousKey = 'malicious]key'; // This prematurely closes the structured-data element: // [bash]key="value" instead of [bash]key="value"]
<h2 style="color: blue;">Protection:</h2>
1. Update immediately to one of the patched versions: 1.3.11, 2.0.14, or 2.1.5.
2. If updating is not immediately possible, disable `includeStructuredData: true` in your SyslogSink configuration (it is non-default).
3. Validate and sanitize all log property keys and values before passing them to the syslog sink, especially if they originate from user-controlled input.
4. For SD-NAME keys, validate against the RFC 5424 grammar:
// SD-NAME: printable US-ASCII, excluding '=', ']', '"', SP; max 32 chars
const SD_NAME_RE = /^[!-<>-Z\\^-z|~]{1,32}$/;
for (const [key, value] of Object.entries(record.properties)) {
if (!SD_NAME_RE.test(key)) continue;
// ... safe to include
}
5. For structured data values, escape all C0 control characters (U+0000–U+001F) in addition to`, ", and ]:
function escapeStructuredDataValue(value) {
return value
.replace(/\/g, "\\")
.replace(/"/g, '\"')
.replace(/]/g, "\]")
.replace(/[\x00-\x1f]/g, (c) =>
`\\x${c.charCodeAt(0).toString(16).padStart(2, "0")}`
);
}
Alternatively, strip them entirely: .replace(/[\x00-\x1f]/g, "")
Impact:
- Forgery: Attackers can forge syslog records attributed to arbitrary hosts, applications, or process IDs.
- Integrity Loss: Attackers can insert records with arbitrary severity or facility levels.
- Obfuscation: Malicious activity can be obscured by injecting misleading entries around legitimate ones.
- SIEM Bypass: Downstream log parsers or SIEM correlation rules that rely on log integrity can be broken.
- Widespread Exposure: Affected downstream collectors include rsyslog, syslog-ng, Splunk, Elastic Stack, and any other system using RFC 6587 non-transparent framing.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
