4 ms·
Actually, I never considered log files untrusted input, but as this example shows, it would be wise to do so.
by arendtio 7y ago
Actually, I never considered log files untrusted input, but as this example shows, it would be wise to do so.
- JoachimSchipper 7y agoFWIW, attacks like Javascript or SQL injection via logfiles are hardly unknown. Log files are plenty scary. ;-)
- mr_toad 7y agoI’ve seen ansi sequences embedded in (malformed) http requests in my server logs. Presumably they expect people to view the log in a terminal or editor with some sort of vulnerability.
- hinkley 7y agoSomeone did a POC of a CSRF against the admin interface for Cisco routers. They sent garbage packets that sufficiently confused the 'hex editor' display view in the admin web pages in such a way that it made a request to another page, changing permissions.
- avodonosov 7y agoAlso beware of CWE-117
- arendtio 7y agohttps://cwe.mitre.org/data/definitions/117.html https://cwe.mitre.org/data/definitions/117.html 'CWE-117: Improper Output Neutralization for Logs' That is something probably often forgotten when simply dumping some requests into a log, but at least it should be obvious that the source of the content is untrusted. On the other hand, a log file is a file on your server, so you would probably think of it as nothing dangerous, as everybody has cared about CWE-117, right? ;-)
- _jal 7y agoOh yes. And a target for PII redaction. Logs need a lot of attention.
- JohnL4 7y agoAs a developer, if I catch an exception handling some piece of data, I'm logging that data. Nothing irks me more than a file-not-found exception without knowing WHICH file. For example.