CVE-2024-58102
📋 TL;DR
This vulnerability in Datalust Seq allows attackers to cause denial of service through stack exhaustion by submitting queries with deeply nested expressions. It affects all Seq instances before version 2024.3.13545 that accept user queries. The insecure default parsing depth limit enables resource exhaustion attacks.
💻 Affected Systems
- Datalust Seq
📦 What is this software?
Seq by Datalust
⚠️ Risk & Real-World Impact
Worst Case
Complete service unavailability due to stack exhaustion, requiring manual restart of Seq service and potential data loss if queries aren't properly queued.
Likely Case
Temporary service degradation or crashes when malicious queries are processed, impacting query functionality and potentially affecting dependent applications.
If Mitigated
Minimal impact with proper query validation, rate limiting, and monitoring in place to detect and block malicious patterns.
🎯 Exploit Status
Exploitation requires ability to submit queries to Seq. No authentication bypass is needed beyond normal query submission permissions. The attack is straightforward once query submission capability is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2024.3.13545 and later
Vendor Advisory: https://github.com/datalust/seq-tickets/issues/2367
Restart Required: Yes
Instructions:
1. Backup your Seq configuration and data. 2. Download Seq 2024.3.13545 or later from datalust.co/seq. 3. Stop the Seq service. 4. Install the updated version. 5. Restart the Seq service. 6. Verify functionality and monitor for issues.
🔧 Temporary Workarounds
Query Depth Limiting
allImplement custom middleware or proxy rules to reject queries exceeding reasonable nesting depth before they reach Seq.
# Example nginx rule to block deep queries
location /api/events/query {
if ($request_body ~* "\{[^{}]*\{[^{}]*\}[^{}]*\}") {
return 400;
}
}
Rate Limiting
allImplement strict rate limiting on query endpoints to prevent rapid exploitation attempts.
# Example using Seq's built-in rate limiting
# Configure in Seq appsettings.json:
"Api": {
"RateLimiting": {
"Enabled": true,
"RequestsPerMinute": 60
}
}
🧯 If You Can't Patch
- Implement network segmentation to restrict query submission to trusted sources only
- Deploy WAF or reverse proxy with rules to detect and block deeply nested JSON patterns
🔍 How to Verify
Check if Vulnerable:
Check Seq version via web interface (Settings > About) or command line: seq versionCheck Version:
seq versionVerify Fix Applied:
Verify version is 2024.3.13545 or later and test with sample deeply nested queries to ensure proper rejection📡 Detection & Monitoring
Log Indicators:
- Stack overflow errors in Seq logs
- Unusually large query payloads
- Rapid sequence of query failures
- High memory consumption alerts
Network Indicators:
- Large POST requests to /api/events/query endpoint
- Rapid query submissions from single source
- Patterns of deeply nested JSON in traffic
SIEM Query:
source="seq" AND ("stack overflow" OR "out of memory" OR "query failed") AND uri_path="/api/events/query"