[Security] Log injection vulnerability in master_api.go

[Security] Log injection vulnerability in master_api.go — unsanitized user data in logs

Description

The masterLogHandle.Process function logs messages from slave nodes without sanitization. Since slaves can send arbitrary data, this allows log injection attacks where malicious clients can inject fake log entries, control terminal output, or exploit log parsing systems.

Context

• File: app/distribute/master_api.go:35
• Function: masterLogHandle.Process

Current vs Expected Behavior

Current: func (*masterLogHandle) Process(receive *teleport.NetData) *teleport.NetData { logs.Log().Informational(" * ") logs.Log().Informational(" * [ %s ] %s", receive.From, receive.Body) logs.Log().Informational(" * ") return nil }

receive.Body contains unvalidated data from network input and is directly logged.

Expected: Sanitize or escape the log message before outputting to prevent injection attacks.

Suggested Fix

import ( "strings" // ... other imports )

func (*masterLogHandle) Process(receive *teleport.NetData) *teleport.NetData { // Sanitize the body to prevent log injection sanitizedBody := strings.Map(func(r rune) rune { if r == '\n' || r == '\r' { return ' ' } return r }, receive.Body)

logs.Log().Informational(" * ")
logs.Log().Informational(" *     [ %s ]    %s", receive.From, sanitizedBody)
logs.Log().Informational(" * ")
return nil

}

Alternatively, consider:

1. Using a structured logging library that escapes user input automatically
2. Truncating excessively long messages
3. Rate-limiting log output to prevent log flooding

Impact

• Severity: Medium
• Affected: All users in distributed mode (server/client)
• Attack vector: Malicious slave nodes can inject fake log entries, break log parsing, or exploit downstream log analysis tools

Positively — happy to submit a PR if this is welcome.