Plaso Forensic Timeline Vulnerability Allows Attackers to Disguise Browser Evidence
Security researchers have disclosed a vulnerability in Plaso
An open-source digital forensic timeline analysis framework, that could allow malicious websites to inject misleading evidence into forensic timelines.
The issue affects Plaso's GoogleAnalyticsUtmzPlugin, which processes "__utmz" cookies associated with Google Analytics. Researchers demonstrated that specially crafted cookie values could overwrite internal event metadata, including the event type and parser information.
In a proof-of-concept examination, researchers inserted manipulated cookies into a Firefox database. When processed by a vulnerable Plaso version, the resulting timeline displayed fabricated entries resembling Chrome browsing history and filesystem activity.
The findings were published on October 29 by the Open Source DFIR blog, featuring research by David André.
The vulnerability also affected automated analysis. Plaso's domain-analysis functionality identified an attacker-controlled domain as visited, even though the evidence originated from a cookie rather than an actual browser history record.
The issue has been addressed through a code change that stores cookie parameters separately instead of allowing them to overwrite internal event attributes. Researchers recommend upgrading to Plaso 20261027.
For digital forensic investigators, the discovery highlights a significant evidentiary concern: automatically generated timelines can misrepresent the origin and meaning of artifacts.
Investigators should verify suspicious entries against original source files, inspect parser provenance and avoid treating automated timeline classifications as independently established facts.
The demonstrated attack involved manipulated test evidence, not a confirmed case of evidence tampering in a real criminal investigation.