Page History

A log injection vulnerability arises when a log entry contains unsanitized user input. A malicious user can insert fake log data and consequently deceive system administrators as to the system's behavior (OWASP 2008). For example, a user might split a legitimate log entry into two log entries by entering a carriage return and line feed (CRLF) sequence, either of which might be misleading. Log injection attacks can be prevented by sanitizing and validating any untrusted input sent to a log.

Logging unsanitized user input can also result in leaking sensitive data across a trust boundary, or storing sensitive data in a manner that is contrary to violates local law or regulation. See rule IDS00-J . Sanitize untrusted data passed across a trust boundary for more details on input sanitization. For instanceexample, if a user is able to can inject an unencrypted credit card number into a log file, the system could violate PCI DSS regulations (PCI DSS Standard2010).

Noncompliant Code Example

...

Without sanitization, a log injection attack is possible. A standard log message when username is "david" might look like this:

May 15, 2011 2:19:10 PM java.util.logging.LogManager$RootLogger log
SEVERE: User login failed for: david

...

This compliant solution sanitizes the username input before logging it, preventing injection attacks. Refer to rule IDS00-J . Sanitize untrusted data passed across a trust boundary for more details on input sanitization.

...

Allowing unvalidated user input to be logged can result in forging of log entries, leaking secure information, or storing sensitive data in a manner that is contrary to violates a local law or regulation.

Related Guidelines

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

Bibliography

...