You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Reverting changes while keeping cosmetics.
Related guidelines and References are now back to having the same content with nested linkage in the related guidelines.
Signed-off-by: myteron <[email protected]>
Copy file name to clipboardExpand all lines: docs/Secure-Coding-Guide-for-Python/CWE-707/CWE-117/README.md
+59-14Lines changed: 59 additions & 14 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,12 +1,12 @@
1
1
# CWE-117: Improper Output Neutralization for Logs
2
2
3
-
Log injection occurs when untrusted data is written to application logs without proper neutralization, allowing attackers to forge log entries or inject malicious content. Attackers can inject fake log records or hide real ones by inserting newline sequences (`\r` or `\n`), misleading auditors and incident-response teams. This vulnerability can also enable injection of `XSS` attacks when logs are viewed in vulnerable web applications.
3
+
Log injection occurs when untrusted data is written to application logs without proper neutralization, allowing attackers to forge log entries or inject malicious content. Attackers can inject fake log records or hide real ones by inserting newline sequences (`\r` or `\n`), misleading auditors and incident-response teams. This vulnerability can also enable injection of XSS attacks when logs are viewed in vulnerable web applications.
4
4
5
-
Attackers can exploit this weakness by submitting strings containing `CRLF` (Carriage Return Line Feed) sequences that create fake log entries. For instance, an attacker authenticating with a crafted username can make failed login attempts appear successful in audit logs, potentially framing innocent users or hiding malicious activity.
5
+
Attackers can exploit this weakness by submitting strings containing Carriage Return Line Feed (CRLF) sequences that create fake log entries. For instance, an attacker authenticating with a crafted username can make failed login attempts appear successful in audit logs, potentially framing innocent users or hiding malicious activity.
6
6
7
-
This vulnerability is classified as **CWE-117: Improper Output Neutralization for Logs**[[CWE-117](https://cwe.mitre.org/data/definitions/117.html)]. It occurs when `CRLF` sequences are not properly neutralized in log output, which is a specific instance of the broader **CWE-93: Improper Neutralization of CRLF Sequences**[[CWE-93](https://cwe.mitre.org/data/definitions/93.html)] weakness. Attackers exploit this using the **CAPEC-93: Log Injection-Tampering-Forging**[[CAPEC-93](https://capec.mitre.org/data/definitions/93.html)] attack pattern.
7
+
This vulnerability is classified as **CWE-117: Improper Output Neutralization for Logs**[[CWE-117](https://cwe.mitre.org/data/definitions/117.html)]. It occurs when CRLF sequences are not properly neutralized in log output, which is a specific instance of the broader **CWE-93: Improper Neutralization of CRLF Sequences**[[CWE-93](https://cwe.mitre.org/data/definitions/93.html)] weakness. Attackers exploit this using the **CAPEC-93: Log Injection-Tampering-Forging**[[CAPEC-93](https://capec.mitre.org/data/definitions/93.html)] attack pattern.
8
8
9
-
The OWASP Top 10 [[OWASP](https://owasp.org/www-project-top-ten/)]lists “Security Logging and Monitoring Failures” as a critical security risk, emphasizing that log data must be encoded correctly to prevent injections.
9
+
The OWASP Top 10 [[OWASP A09:2021](https://owasp.org/www-project-top-ten/)]lists “Security Logging and Monitoring Failures” as a critical security risk, emphasizing that log data must be encoded correctly to prevent injections.
<td><a href="https://owasp.org/www-project-application-security-verification-standard/">OWASP Application Security Verification Standard (ASVS) </a>[OWASP ASVS 4.0]</td>
158
+
</tr>
159
+
<tr>
160
+
<td>ISO/IEC TR 24772:2013</td>
161
+
<td><a href="https://www.iso.org/standard/61457.html">ISO/IEC TR 24772:2013 Information technology — Programming languages — Guidance to avoiding vulnerabilities in programming languages through language selection and use </a>[ISO 24772:2013]</td>
<td>CWE-707: Improper Neutralization [online]. Available from <a href="https://cwe.mitre.org/data/definitions/707.html">https://cwe.mitre.org/data/definitions/707.html</a>, [Accessed 24 September 2025]</td>
175
+
</tr>
176
+
<tr>
177
+
<td>[CWE-117]</a></td>
178
+
<td>CWE-117: Improper Output Neutralization for Log [online]. Available from <a href="https://cwe.mitre.org/data/definitions/117.html">https://cwe.mitre.org/data/definitions/117.html</a>, [Accessed 24 September 2025]</td>
179
+
</tr>
180
+
<tr>
181
+
<td>[CWE-93]</a></td>
182
+
<td>CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection') [online]. Available from: <a href="https://cwe.mitre.org/data/definitions/93.html">https://cwe.mitre.org/data/definitions/93.html</a>, [Accessed 24 September 2025]</td>
183
+
</tr>
184
+
<tr>
185
+
<td>[CWE-113]</a></td>
186
+
<td>CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')<a href="https://cwe.mitre.org/data/definitions/113.html">https://cwe.mitre.org/data/definitions/113.html</a>, [Accessed 24 September 2025]</td>
187
+
</tr>
188
+
<tr>
189
+
<td>[CAPEC-93]</td>
190
+
<td>CAPEC-93: Log Injection-Tampering-Forging [online]. Available from: <a href="https://capec.mitre.org/data/definitions/93.html">https://capec.mitre.org/data/definitions/93.html</a>, [Accessed 24 September 2025]</td>
191
+
</tr>
192
+
<tr>
193
+
<td>[OWASP A09:2021]</td>
194
+
<td>A09:2021 – Security Logging and Monitoring Failures [online]. Available from:<a href="https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures/">https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures/</a>, [Accessed 24 September 2025]</td>
195
+
</tr>
160
196
<tr>
161
197
<td>[OWASP ASVS 4.0]</td>
162
-
<td>Python Software Foundation. (2024). concurrent.futures — Launching parallel tasks [online]. Available from: <a href="https://docs.python.org/3.10/library/concurrent.futures.html">https://docs.python.org/3.10/library/concurrent.futures.html</a>, [Accessed 18 September 2025]</td>
198
+
<td>OWASP Application Security Verification Standard (ASVS) [online]. Available from: <a href="https://owasp.org/www-project-application-security-verification-standard/">https://owasp.org/www-project-application-security-verification-standard/</a>, [Accessed 24 September 2025]</td>
199
+
</tr>
200
+
<tr>
201
+
<td>[ISO 24772:2013]</td>
202
+
<td>ISO/IEC TR 24772:2013 Information technology — Programming languages — Guidance to avoiding vulnerabilities in programming languages through language selection and use [online]. Available from:
203
+
<a href="https://www.iso.org/standard/61457.html">https://www.iso.org/standard/61457.html</a>, [Accessed 24 September 2025]</td>
204
+
</tr>
205
+
<tr>
206
+
<td>[NIST SP 800-92]</td>
207
+
<td>NIST SP 800-92 Guide to Computer Security Log Management [online]. Available from:<a href="https://csrc.nist.gov/pubs/sp/800/92/final">https://csrc.nist.gov/pubs/sp/800/92/final</a>, [Accessed 24 September 2025]</td>
0 commit comments