271
CanPrecede 117 Improper Output Neutralization for Logs 288
Relevant to the view "Architectural Concepts" (CWE-1008)
Nature Type ID Name Page
MemberOf 1019 Validate Inputs 2433
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 137 Data Neutralization Issues 2311
Weakness Ordinalities
Primary :
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Integrity Modify Application Data
Detection Methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST),
can find some instances of this weakness by analyzing source code (or binary/compiled code)
without having to execute it. Typically, this is done by building a model of data flow and control
flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input)
with "sinks" (destinations where the data interacts with external components, a lower layer such
as the OS, etc.)
Effectiveness = High
Potential Mitigations
Phase: Implementation
Avoid using CRLF as a special sequence.
Phase: Implementation
Appropriately filter or quote CRLF sequences in user-controlled input.
Demonstrative Examples
Example 1:
If user input data that eventually makes it to a log message isn't checked for CRLF characters, it
may be possible for an attacker to forge entries in a log file.
Example Language: Java (Bad)
logger.info("User's street address: " + request.getParameter("streetAddress"));
Observed Examples
CWE Version 4.14
CWE-94: Improper Control of Generation of Code ('Code Injection')
CWE-94: Improper Control of Generation of Code ('Code Injection')