291
If a user submits the string "twenty-one" for val, the following entry is logged:
• INFO: Failed to parse val=twenty-one
However, if an attacker submits the string "twenty-one%0a%0aINFO:+User+logged+out
%3dbadguy", the following entry is logged:
• INFO: Failed to parse val=twenty-one
• INFO: User logged out=badguy
Clearly, attackers can use this same mechanism to insert arbitrary log entries.
Observed Examples
Reference Description
CVE-2006-4624 Chain: inject fake log entries with fake timestamps using CRLF injection
https://www.cve.org/CVERecord?id=CVE-2006-4624
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 727 OWASP Top Ten 2004 Category A6 - Injection Flaws 711 2337
MemberOf 884 CWE Cross-section 884 2567
MemberOf 963 SFP Secondary Cluster: Exposed Data 888 2400
MemberOf 1134 SEI CERT Oracle Secure Coding Standard for Java -
Guidelines 00. Input Validation and Data Sanitization
(IDS)
1133 2444
MemberOf 1355 OWASP Top Ten 2021 Category A09:2021 - Security
Logging and Monitoring Failures
1344 2496
MemberOf 1407 Comprehensive Categorization: Improper Neutralization 1400 2532
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
7 Pernicious Kingdoms Log Forging
Software Fault Patterns SFP23 Exposed Data
The CERT Oracle Secure
Coding Standard for Java
(2011)
IDS03-J Exact Do not log unsanitized user input
SEI CERT Oracle Coding
Standard for Java
IDS03-J Exact Do not log unsanitized user input
Related Attack Patterns
CAPEC-ID Attack Pattern Name
81 Web Server Logs Tampering
93 Log Injection-Tampering-Forging
268 Audit Log Manipulation
References
[REF-6]Katrina Tsipenyuk, Brian Chess and Gary McGraw. "Seven Pernicious Kingdoms: A
Taxonomy of Software Security Errors". NIST Workshop on Software Security Assurance Tools
Techniques and Metrics. 2005 November 7. NIST. < https://samate.nist.gov/SSATTM_Content/
papers/Seven%20Pernicious%20Kingdoms%20-%20Taxonomy%20of%20Sw%20Security
%20Errors%20-%20Tsipenyuk%20-%20Chess%20-%20McGraw.pdf >.
CWE Version 4.14
CWE-118: Incorrect Access of Indexable Resource ('Range Error')
CWE-118: Incorrect Access of Indexable Resource ('Range Error')