CiscoSecurity / fp-05-firepower-cli

Public Repo for an eStreamer CLI project
10 stars 8 forks source link

"=" not escaped when the CEF message constructed #26

Open ArmsSec opened 5 months ago

ArmsSec commented 5 months ago

the __sanitize function in cef.py is missing the escape of the "=" character. The CEF message will not get parsed correctly if there are values that will include "=" since it will treat that as a new set of key-value pair. this should be included in the code: value = value.replace('=', '\=') As an example if the logs include the URI requested by the user, that usually have "=" sign, the message will not get parsed correctly.