zakirkun Log Injection
Overview
Log injection occurs when user-supplied data is written to log files without sanitizing newline characters. Attackers can:
- Forge log entries to cover their tracks or frame innocent users
- Inject fake log lines to mislead incident responders
- Exploit log viewer vulnerabilities (XSS in web-based log viewers)
- In some cases, exploit log4j-style lookup injection (Log4Shell)
Detection Strategy
Look for logging calls that directly include user-supplied request parameters.
Remediation
- Strip or encode
\r,\n, and ANSI escape sequences from values before logging - Use structured logging (JSON) which prevents newline-based injection
- Log the value in a structured field, not interpolated into a message string
Vulnerable (Node.js):
const username = req.body.username;
logger.info(`User login attempt: ${username}`); // injection via \n
Safe (Node.js):
logger.info('User login attempt', { username: username.replace(/[\r\n]/g, '') });