Net::Statsd::Lite Metric Injection Vulnerability

A vulnerability in Net::Statsd::Lite for Perl, affecting versions prior to 0.9.0, allowed for metric injection. The issue arose because metric names were not properly validated, enabling the injection of additional StatsD metrics from untrusted sources. Specifically, names could include newlines, colons, or pipes, which are not permitted by the StatsD protocol.

Impact

Exploitation of this vulnerability could lead to unauthorized metric injection, allowing attackers to manipulate or disrupt monitoring and logging systems that rely on StatsD for metric collection.

Remediation

Users can upgrade to Net::Statsd::Lite version 0.9.0 or later, where this vulnerability has been addressed. The updated version is available on CPAN.