560
writeLog("Failed login attempt by User: " . $userName . " at " + date('r') );
}
}
}
This code only logs failed login attempts when a certain limit is reached. If an attacker knows this
limit, they can stop their attack from being discovered by avoiding the limit.
Example 2:
This code prints the contents of a file if a user has permission.
Example Language: PHP (Bad)
function readFile($filename){
$user = getCurrentUser();
$realFile = $filename;
//resolve file if its a symbolic link
if(is_link($filename)){
$realFile = readlink($filename);
}
if(fileowner($realFile) == $user){
echo file_get_contents($realFile);
return;
}
else{
echo 'Access denied';
writeLog($user . ' attempted to access the file '. $filename . ' on '. date('r'));
}
}
While the code logs a bad access attempt, it logs the user supplied name for the file, not the
canonicalized file name. An attacker can obscure their target by giving the script the name of a link
to the file they are attempting to access. Also note this code contains a race condition between the
is_link() and readlink() functions (CWE-363).
Observed Examples
Reference Description
CVE-1999-1029 Login attempts are not recorded if the user disconnects before the maximum
number of tries.
https://www.cve.org/CVERecord?id=CVE-1999-1029
CVE-2002-1839 Sender's IP address not recorded in outgoing e-mail.
https://www.cve.org/CVERecord?id=CVE-2002-1839
CVE-2000-0542 Failed authentication attempts are not recorded if later attempt succeeds.
https://www.cve.org/CVERecord?id=CVE-2000-0542
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 884 CWE Cross-section 884 2567
MemberOf 997 SFP Secondary Cluster: Information Loss 888 2418
MemberOf 1036 OWASP Top Ten 2017 Category A10 - Insufficient
Logging & Monitoring
1026 2439
MemberOf 1355 OWASP Top Ten 2021 Category A09:2021 - Security
Logging and Monitoring Failures
1344 2496
MemberOf 1413 Comprehensive Categorization: Protection Mechanism
Failure
1400 2542
CWE Version 4.14
CWE-224: Obscured Security-relevant Information by Alternate Name
CWE-224: Obscured Security-relevant Information by Alternate Name