CVE-2025-27911

Executive Summary

CVE-2025-27911 is a denial-of-service (DoS) vulnerability in Datalust Seq, a centralized structured log server. The flaw resides in the message template expansion mechanism, where specially crafted log events can bypass the configured "Event body limit bytes" setting. This allows an attacker to send events that, upon expansion, consume excessive memory or disk space, leading to resource exhaustion. The vulnerability is rated with a CVSS score of 6.5 (Medium) and has no known public proof-of-concept or exploit code at this time. The primary impact is on availability, as an attacker can cause the Seq server to terminate due to an out-of-memory (OOM) error or fill the disk with oversized events.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Base Score: 6.5 (Medium)
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – No authentication is needed.
• User Interaction: None (UI:N) – No user action is required.
• Scope: Unchanged (S:U) – The impact is confined to the vulnerable component.
• Confidentiality Impact: None (C:N) – No data is exposed.
• Integrity Impact: None (I:N) – No data is altered.
• Availability Impact: High (A:H) – The server can crash or become unresponsive.

Threat Level: Medium. While the CVSS score is moderate, the ease of exploitation (no authentication, low complexity) and the potential for complete service disruption elevate the risk for organizations relying on Seq for log management.

Deep Dive & Mechanics

Seq uses message templates to format log events. These templates can contain placeholders (identifiers) that are expanded at runtime. The vulnerability arises because the expansion of these identifiers is not properly bounded by the "Event body limit bytes" setting. An attacker can craft a log event with a small initial payload that, when expanded, grows exponentially or to an extremely large size.

Technical Breakdown:

1. Message Template Expansion: Seq processes log events by expanding placeholders like {@timestamp}, {@message}, or custom properties. The expansion logic substitutes the placeholder with the actual value.
2. Bypass of Size Limit: The "Event body limit bytes" setting is intended to cap the size of the raw event body. However, the expansion occurs after this check, meaning a small event body can expand into a massive string.
3. Resource Consumption: The expanded event consumes memory proportional to its final size. If the expansion results in a string larger than available memory, the server process may crash with an out-of-memory (OOM) error. If events are persisted to disk, the disk can fill up, causing further service degradation.

Attack Scenario: An attacker sends a POST request to the Seq ingestion endpoint (e.g., /api/events/raw) with a crafted JSON payload containing a message template that references a deeply nested or recursive property. For example:

{
  "Events": [
    {
      "MessageTemplate": "{@message}",
      "Properties": {
        "@message": "{@message}"
      }
    }
  ]
}

This creates a recursive expansion that can quickly exhaust resources.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable: Expansion occurs without size check after limit enforcement
public string ExpandTemplate(string template, IDictionary<string, object> properties)
{
    // This expansion does not enforce the event body limit
    return Regex.Replace(template, @"\{(\w+)\}", match =>
    {
        var key = match.Groups[1].Value;
        return properties.ContainsKey(key) ? properties[key].ToString() : match.Value;
    });
}

Patched Code (Conceptual):

// Patched: Expansion enforces a maximum output size
public string ExpandTemplate(string template, IDictionary<string, object> properties, int maxSize)
{
    var result = new StringBuilder();
    int currentSize = 0;
    // Expansion logic with size check
    foreach (var segment in SplitTemplate(template))
    {
        var expanded = ExpandSegment(segment, properties);
        currentSize += expanded.Length;
        if (currentSize > maxSize)
            throw new EventTooLargeException("Expanded event exceeds limit");
        result.Append(expanded);
    }
    return result.ToString();
}

The patch introduces a size limit during the expansion process, ensuring that the final event body does not exceed the configured limit.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A vulnerable Datalust Seq instance (version < 2024.3.13545)
• Network access to the Seq ingestion endpoint (default port 5341)

Exploitation Steps:

1. Identify Target: Scan for Seq instances using Shodan dorks or network scanning.
2. Craft Payload: Create a JSON payload with a recursive or deeply nested property that expands to a large size.
3. Send Payload: Use curl or a custom script to send the payload to the /api/events/raw endpoint.

Example Payload:

{
  "Events": [
    {
      "MessageTemplate": "{@message}",
      "Properties": {
        "@message": "A" + "A".PadLeft(1000000, 'A')
      }
    }
  ]
}

Note: This is a simplified example. Actual exploitation may require more sophisticated recursion.

Curl Command:

curl -X POST http://target:5341/api/events/raw \
  -H "Content-Type: application/json" \
  -d '{"Events":[{"MessageTemplate":"{@message}","Properties":{"@message":"A" + "A".PadLeft(1000000, 'A')}}]}'

Expected Outcome: The Seq server may crash with an OOM error or become unresponsive.

Blue Team (Defensive)

Detection:

• Monitor for unusually large event payloads in Seq ingestion logs.
• Set up alerts for high memory or disk usage on the Seq server.
• Use network monitoring to detect repeated POST requests to /api/events/raw with suspicious patterns.

Mitigation:

• Immediately upgrade to Seq version 2024.3.13545 or later.
• If upgrade is not possible, restrict network access to the Seq ingestion endpoint using firewall rules.
• Implement rate limiting on the ingestion endpoint to reduce the impact of a DoS attack.
• Monitor Seq logs for events that exceed normal size thresholds.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Repeated POST requests to /api/events/raw with large or recursive JSON payloads.
  • Source IP addresses sending anomalous amounts of data to the Seq server.
• System IOCs:
  • Seq server process crashing with out-of-memory errors.
  • Disk space on the Seq server filling up rapidly.
  • Seq logs showing events with unusually large expanded sizes.
• File IOCs:
  • Large event files in the Seq storage directory (e.g., /var/lib/seq/).

Detection Engineering

YARA Rule

rule CVE_2025_27911_Seq_DoS {
    meta:
        description = "Detects potential exploitation of CVE-2025-27911 in Datalust Seq"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-27911"
    strings:
        $json_payload = /"MessageTemplate"\s*:\s*"\{[^}]*\}"/ nocase
        $recursive_prop = /"@message"\s*:\s*"\{@message\}"/ nocase
        $large_string = /"A{1000,}"/ nocase
    condition:
        any of ($json_payload, $recursive_prop, $large_string)
}

Sigma Rule

title: CVE-2025-27911 - Datalust Seq DoS Exploitation Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects attempts to exploit CVE-2025-27911 by sending oversized or recursive event payloads to Seq.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: seq
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/api/events/raw'
        cs-bytes: '>1000000'  # Payloads larger than 1 MB
    condition: selection
falsepositives:
    - Legitimate large log events from high-volume sources
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET 5341 (msg:"CVE-2025-27911 - Datalust Seq DoS Exploitation Attempt"; flow:to_server; content:"POST"; http_method; content:"/api/events/raw"; http_uri; content:"MessageTemplate"; http_client_body; pcre:"/\\{@message\\}/i"; threshold: type both, track by_src, count 10, seconds 60; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update Datalust Seq to version 2024.3.13545 or later. This is the only complete fix.
2. Network Segmentation: Restrict access to the Seq ingestion endpoint to trusted IP addresses only.
3. Rate Limiting: Implement rate limiting on the /api/events/raw endpoint to reduce the impact of a DoS attack.

Long-Term Measures:

• Monitoring: Continuously monitor Seq server resource usage (CPU, memory, disk) and set up alerts for anomalies.
• Input Validation: If possible, implement additional input validation at the reverse proxy level to reject events with suspiciously large or recursive payloads.
• Backup: Ensure regular backups of Seq data to recover from disk exhaustion.

Workarounds (if upgrade is not possible):

• Disable the ingestion of raw events if not required.
• Use a Web Application Firewall (WAF) to filter out requests with recursive patterns.

Valters IT