Improper Escaping of Label Values Allows Metric Injection in Exposition Output

[Tanish-26]

Summary

While reviewing prometheus-client-c, I identified an issue in the metric formatting logic where label values are rendered into Prometheus exposition format without escaping reserved characters.

As a result, label values containing quotation marks (") and newline characters (\n) can alter the structure of the generated metric stream.

This allows attacker-controlled input to escape the intended label context and introduce additional metrics into the exposition output.

Affected Area

Repository: prometheus-client-c

Relevant component:

prom/src/prom_metric_formatter.c

The formatter appends user-controlled label values directly into the output stream without escaping special characters required by the Prometheus text exposition format.

Expected Behavior

Label values should be escaped according to the Prometheus exposition format specification.

At minimum:

"   -> \"
\   -> \\
\n  -> \n

Observed Behavior

A crafted label value containing reserved characters can modify the generated metric stream and introduce unintended metric definitions.

Example structure:

metric_name{label="USER_INPUT"} 1

When special characters are not escaped, the resulting output may no longer represent the original metric structure.

Impact

Potential impacts include:

• Monitoring data integrity issues
• Unauthorized metric creation
• Alert manipulation
• TSDB poisoning
• Excessive cardinality generation through injected label values

In testing, Prometheus successfully accepted and stored metrics generated from malformed exposition output.

Recommended Fix

Implement proper escaping of reserved characters before writing label values into the exposition stream.

Example handling:

case '"':
    /* escape quote */
    break;

case '\\':
    /* escape backslash */
    break;

case '\n':
    /* escape newline */
    break;

Additional hardening suggestions:

• Reject multi-line label values
• Apply label length limits
• Add regression tests covering malicious label content

Disclosure

I previously contacted DigitalOcean Product Security regarding this issue and was advised to submit the report through GitHub.

I am happy to provide additional reproduction details, logs, or validation information if needed.