289
Relevant to the view "Architectural Concepts" (CWE-1008)
Nature Type ID Name Page
MemberOf 1009 Audit 2424
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 1210 Audit / Logging Errors 2475
MemberOf 137 Data Neutralization Issues 2311
Relevant to the view "Seven Pernicious Kingdoms" (CWE-700)
Nature Type ID Name Page
ChildOf 20 Improper Input Validation 20
Weakness Ordinalities
Primary :
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Background Details
Applications typically use log files to store a history of events or transactions for later review,
statistics gathering, or debugging. Depending on the nature of the application, the task of reviewing
log files may be performed manually on an as-needed basis or automated with a tool that
automatically culls logs for important events or trending information.
Likelihood Of Exploit
Medium
Common Consequences
Scope Impact Likelihood
Integrity
Confidentiality
Availability
Non-Repudiation
Modify Application Data
Hide Activities
Execute Unauthorized Code or Commands
Interpretation of the log files may be hindered or
misdirected if an attacker can supply data to the
application that is subsequently logged verbatim. In the
most benign case, an attacker may be able to insert false
entries into the log file by providing the application with
input that includes appropriate characters. Forged or
otherwise corrupted log files can be used to cover an
attacker's tracks, possibly by skewing statistics, or even to
implicate another party in the commission of a malicious
act. If the log file is processed automatically, the attacker
can render the file unusable by corrupting the format of the
file or injecting unexpected characters. An attacker may
inject code or other commands into the log file and take
advantage of a vulnerability in the log processing utility.
Detection Methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST),
can find some instances of this weakness by analyzing source code (or binary/compiled code)
without having to execute it. Typically, this is done by building a model of data flow and control
flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input)
CWE Version 4.14
CWE-117: Improper Output Neutralization for Logs
CWE-117: Improper Output Neutralization for Logs