-
Notifications
You must be signed in to change notification settings - Fork 634
sei: packages potentially using incorrect mustache snippet escaping #7641
Copy link
Copy link
Open
Labels
Integration:1password1Password1PasswordIntegration:akamaiAkamaiAkamaiIntegration:atlassian_bitbucketAtlassian BitbucketAtlassian BitbucketIntegration:atlassian_confluenceAtlassian ConfluenceAtlassian ConfluenceIntegration:atlassian_jiraAtlassian JiraAtlassian JiraIntegration:auditdAuditd LogsAuditd LogsIntegration:awsAWSAWSIntegration:barracudaBarracuda Web Application FirewallBarracuda Web Application FirewallIntegration:bitdefenderBitDefenderBitDefenderIntegration:bluecoatBlue Coat Director Logs (Deprecated)Blue Coat Director Logs (Deprecated)Integration:carbonblack_edrVMware Carbon Black EDRVMware Carbon Black EDRIntegration:cefCommon Event Format (CEF)Common Event Format (CEF)Integration:checkpointCheck PointCheck PointIntegration:cisco_asaCisco ASACisco ASAIntegration:cisco_iosCisco IOSCisco IOSIntegration:cisco_iseCisco ISECisco ISEIntegration:cisco_secure_endpointCisco Secure EndpointCisco Secure EndpointIntegration:cisco_umbrellaCisco UmbrellaCisco UmbrellaIntegration:citrix_wafCitrix Web App FirewallCitrix Web App FirewallIntegration:cloudflareCloudflareCloudflareIntegration:cloudflare_logpushCloudflare LogpushCloudflare LogpushIntegration:crowdstrikeCrowdStrikeCrowdStrikeIntegration:cyberark_ptaCyberark Privileged Threat AnalyticsCyberark Privileged Threat AnalyticsIntegration:cylanceCylanceProtect Logs (Deprecated)CylanceProtect Logs (Deprecated)Integration:entityanalytics_entra_idMicrosoft Entra ID Entity AnalyticsMicrosoft Entra ID Entity AnalyticsIntegration:fireeyeFireEye Network Security (Community supported)FireEye Network Security (Community supported)Integration:forcepoint_webForcepoint Web Security (Community supported)Forcepoint Web Security (Community supported)Integration:forgerockForgeRockForgeRockIntegration:fortinet_forticlientFortinet FortiClient Logs (Deprecated)Fortinet FortiClient Logs (Deprecated)Integration:fortinet_fortiedrFortinet FortiEDR LogsFortinet FortiEDR LogsIntegration:fortinet_fortigateFortinet FortiGate Firewall LogsFortinet FortiGate Firewall LogsIntegration:gcpGoogle Cloud PlatformGoogle Cloud PlatformIntegration:githubGitHubGitHubIntegration:google_workspaceGoogle WorkspaceGoogle WorkspaceIntegration:hid_bravura_monitorBravura Monitor (Partner supported)Bravura Monitor (Partner supported)Integration:impervaImpervaImpervaIntegration:infoblox_niosInfoblox NIOSInfoblox NIOSIntegration:jumpcloudJumpCloudJumpCloudIntegration:juniper_junosJuniper JunOS (Deprecated)Juniper JunOS (Deprecated)Integration:juniper_netscreenJuniper NetScreen (Deprecated)Juniper NetScreen (Deprecated)Integration:juniper_srxJuniper SRXJuniper SRXIntegration:keycloakKeycloakKeycloakIntegration:lyve_cloudLyve Cloud (Partner supported)Lyve Cloud (Partner supported)Integration:m365_defenderMicrosoft Defender XDRMicrosoft Defender XDRIntegration:mattermostMattermost (Community supported)Mattermost (Community supported)Integration:microsoft_defender_endpointMicrosoft Defender for EndpointMicrosoft Defender for EndpointIntegration:microsoft_dhcpMicrosoft DHCPMicrosoft DHCPIntegration:microsoft_sqlserverMicrosoft SQL ServerMicrosoft SQL ServerIntegration:mimecastMimecastMimecastIntegration:modsecurityModSecurity Audit (Community supported)ModSecurity Audit (Community supported)Integration:mysql_enterpriseMySQL Enterprise (Audit Logs)MySQL Enterprise (Audit Logs)Integration:nagios_xiNagios XINagios XIIntegration:netflowNetFlow RecordsNetFlow RecordsIntegration:netscoutArbor Peakflow SP Logs (Deprecated)Arbor Peakflow SP Logs (Deprecated)Integration:netskopeNetskopeNetskopeIntegration:network_trafficNetwork Packet CaptureNetwork Packet CaptureIntegration:o365Microsoft Office 365Microsoft Office 365Integration:oktaOktaOktaIntegration:osqueryOsquery LogsOsquery LogsIntegration:pfsensepfSense (Community supported)pfSense (Community supported)Integration:pulse_connect_securePulse Connect Secure (Community supported)Pulse Connect Secure (Community supported)Integration:qnap_nasQNAP NAS (Community supported)QNAP NAS (Community supported)Integration:radwareRadware DefensePro Logs (Deprecated)Radware DefensePro Logs (Deprecated)Integration:santaGoogle SantaGoogle SantaIntegration:slackSlack LogsSlack LogsIntegration:snortSnortSnortIntegration:snykSnykSnykIntegration:sophosSophosSophosIntegration:squidSquid ProxySquid ProxyIntegration:suricataSuricataSuricataIntegration:symantec_endpointSymantec Endpoint ProtectionSymantec Endpoint ProtectionIntegration:sysmon_linuxSysmon for LinuxSysmon for LinuxIntegration:systemSystemSystemIntegration:system_auditSystem AuditSystem AuditIntegration:tenable_ioTenable Vulnerability ManagementTenable Vulnerability ManagementIntegration:thycotic_ssThycotic Secret Server (Community supported)Thycotic Secret Server (Community supported)Integration:ti_abusechabuse.chabuse.chIntegration:ti_cif3Collective Intelligence Framework v3 (Community supported)Collective Intelligence Framework v3 (Community supported)Integration:ti_cybersixgillCybersixgillCybersixgillIntegration:ti_maltiverseMaltiverse (Partner supported)Maltiverse (Partner supported)Integration:ti_mispMISPMISPIntegration:trendmicroTrendAI Deep SecurityTrendAI Deep SecurityIntegration:windowsWindowsWindowsIntegration:zeekZeekZeekIntegration:zeronetworksZero Networks (Partner supported)Zero Networks (Partner supported)Integration:zoomZoomZoomTeam:SDE-CrestCrest developers on the Security Integrations team [elastic/sit-crest-contractors]Crest developers on the Security Integrations team [elastic/sit-crest-contractors]Team:Security-Deployment and DevicesDEPRECATED Deployment and Devices Security team [elastic/sec-deployment-and-devices]DEPRECATED Deployment and Devices Security team [elastic/sec-deployment-and-devices]Team:Security-ScalabilitySecurity Integrations Scalability teamSecurity Integrations Scalability teamTeam:Security-Service IntegrationsSecurity Service Integrations team [elastic/security-service-integrations]Security Service Integrations team [elastic/security-service-integrations]bugSomething isn't working, use only for issuesSomething isn't working, use only for issuestechnical-debt
Description
Metadata
Metadata
Assignees
Labels
Integration:1password1Password1PasswordIntegration:akamaiAkamaiAkamaiIntegration:atlassian_bitbucketAtlassian BitbucketAtlassian BitbucketIntegration:atlassian_confluenceAtlassian ConfluenceAtlassian ConfluenceIntegration:atlassian_jiraAtlassian JiraAtlassian JiraIntegration:auditdAuditd LogsAuditd LogsIntegration:awsAWSAWSIntegration:barracudaBarracuda Web Application FirewallBarracuda Web Application FirewallIntegration:bitdefenderBitDefenderBitDefenderIntegration:bluecoatBlue Coat Director Logs (Deprecated)Blue Coat Director Logs (Deprecated)Integration:carbonblack_edrVMware Carbon Black EDRVMware Carbon Black EDRIntegration:cefCommon Event Format (CEF)Common Event Format (CEF)Integration:checkpointCheck PointCheck PointIntegration:cisco_asaCisco ASACisco ASAIntegration:cisco_iosCisco IOSCisco IOSIntegration:cisco_iseCisco ISECisco ISEIntegration:cisco_secure_endpointCisco Secure EndpointCisco Secure EndpointIntegration:cisco_umbrellaCisco UmbrellaCisco UmbrellaIntegration:citrix_wafCitrix Web App FirewallCitrix Web App FirewallIntegration:cloudflareCloudflareCloudflareIntegration:cloudflare_logpushCloudflare LogpushCloudflare LogpushIntegration:crowdstrikeCrowdStrikeCrowdStrikeIntegration:cyberark_ptaCyberark Privileged Threat AnalyticsCyberark Privileged Threat AnalyticsIntegration:cylanceCylanceProtect Logs (Deprecated)CylanceProtect Logs (Deprecated)Integration:entityanalytics_entra_idMicrosoft Entra ID Entity AnalyticsMicrosoft Entra ID Entity AnalyticsIntegration:fireeyeFireEye Network Security (Community supported)FireEye Network Security (Community supported)Integration:forcepoint_webForcepoint Web Security (Community supported)Forcepoint Web Security (Community supported)Integration:forgerockForgeRockForgeRockIntegration:fortinet_forticlientFortinet FortiClient Logs (Deprecated)Fortinet FortiClient Logs (Deprecated)Integration:fortinet_fortiedrFortinet FortiEDR LogsFortinet FortiEDR LogsIntegration:fortinet_fortigateFortinet FortiGate Firewall LogsFortinet FortiGate Firewall LogsIntegration:gcpGoogle Cloud PlatformGoogle Cloud PlatformIntegration:githubGitHubGitHubIntegration:google_workspaceGoogle WorkspaceGoogle WorkspaceIntegration:hid_bravura_monitorBravura Monitor (Partner supported)Bravura Monitor (Partner supported)Integration:impervaImpervaImpervaIntegration:infoblox_niosInfoblox NIOSInfoblox NIOSIntegration:jumpcloudJumpCloudJumpCloudIntegration:juniper_junosJuniper JunOS (Deprecated)Juniper JunOS (Deprecated)Integration:juniper_netscreenJuniper NetScreen (Deprecated)Juniper NetScreen (Deprecated)Integration:juniper_srxJuniper SRXJuniper SRXIntegration:keycloakKeycloakKeycloakIntegration:lyve_cloudLyve Cloud (Partner supported)Lyve Cloud (Partner supported)Integration:m365_defenderMicrosoft Defender XDRMicrosoft Defender XDRIntegration:mattermostMattermost (Community supported)Mattermost (Community supported)Integration:microsoft_defender_endpointMicrosoft Defender for EndpointMicrosoft Defender for EndpointIntegration:microsoft_dhcpMicrosoft DHCPMicrosoft DHCPIntegration:microsoft_sqlserverMicrosoft SQL ServerMicrosoft SQL ServerIntegration:mimecastMimecastMimecastIntegration:modsecurityModSecurity Audit (Community supported)ModSecurity Audit (Community supported)Integration:mysql_enterpriseMySQL Enterprise (Audit Logs)MySQL Enterprise (Audit Logs)Integration:nagios_xiNagios XINagios XIIntegration:netflowNetFlow RecordsNetFlow RecordsIntegration:netscoutArbor Peakflow SP Logs (Deprecated)Arbor Peakflow SP Logs (Deprecated)Integration:netskopeNetskopeNetskopeIntegration:network_trafficNetwork Packet CaptureNetwork Packet CaptureIntegration:o365Microsoft Office 365Microsoft Office 365Integration:oktaOktaOktaIntegration:osqueryOsquery LogsOsquery LogsIntegration:pfsensepfSense (Community supported)pfSense (Community supported)Integration:pulse_connect_securePulse Connect Secure (Community supported)Pulse Connect Secure (Community supported)Integration:qnap_nasQNAP NAS (Community supported)QNAP NAS (Community supported)Integration:radwareRadware DefensePro Logs (Deprecated)Radware DefensePro Logs (Deprecated)Integration:santaGoogle SantaGoogle SantaIntegration:slackSlack LogsSlack LogsIntegration:snortSnortSnortIntegration:snykSnykSnykIntegration:sophosSophosSophosIntegration:squidSquid ProxySquid ProxyIntegration:suricataSuricataSuricataIntegration:symantec_endpointSymantec Endpoint ProtectionSymantec Endpoint ProtectionIntegration:sysmon_linuxSysmon for LinuxSysmon for LinuxIntegration:systemSystemSystemIntegration:system_auditSystem AuditSystem AuditIntegration:tenable_ioTenable Vulnerability ManagementTenable Vulnerability ManagementIntegration:thycotic_ssThycotic Secret Server (Community supported)Thycotic Secret Server (Community supported)Integration:ti_abusechabuse.chabuse.chIntegration:ti_cif3Collective Intelligence Framework v3 (Community supported)Collective Intelligence Framework v3 (Community supported)Integration:ti_cybersixgillCybersixgillCybersixgillIntegration:ti_maltiverseMaltiverse (Partner supported)Maltiverse (Partner supported)Integration:ti_mispMISPMISPIntegration:trendmicroTrendAI Deep SecurityTrendAI Deep SecurityIntegration:windowsWindowsWindowsIntegration:zeekZeekZeekIntegration:zeronetworksZero Networks (Partner supported)Zero Networks (Partner supported)Integration:zoomZoomZoomTeam:SDE-CrestCrest developers on the Security Integrations team [elastic/sit-crest-contractors]Crest developers on the Security Integrations team [elastic/sit-crest-contractors]Team:Security-Deployment and DevicesDEPRECATED Deployment and Devices Security team [elastic/sec-deployment-and-devices]DEPRECATED Deployment and Devices Security team [elastic/sec-deployment-and-devices]Team:Security-ScalabilitySecurity Integrations Scalability teamSecurity Integrations Scalability teamTeam:Security-Service IntegrationsSecurity Service Integrations team [elastic/security-service-integrations]Security Service Integrations team [elastic/security-service-integrations]bugSomething isn't working, use only for issuesSomething isn't working, use only for issuestechnical-debt
The mustache templating system used by ingest pipelines has two levels of escaping available, not escaped (triple stache) and HTML escaped (double stache) — see man mustache under "tag types: variables". This can lead to data corruption, particularly in cases where an operating system has chosen to use a character requiring escaping in its path syntax (example here).
In general we should not be HTML escaping fields for ingestion, so it is nearly always the case that we should be using the triple stache. This is not the case; this is a list of SEI packages that have at least one instance of a double stache in a template snippet: