Skip to main content

Log injection

Need​

Prevention of log injection attacks

Context​

  • Usage of PHP for server-side web development
  • Usage of Illuminate\Http\Request for handling HTTP requests in Laravel
  • Usage of Log for logging and debugging purposes

Description​

Non compliant code​

<?php

namespace App\\Http\\Controllers;

use Illuminate\\Http\\Request;
use Log;

class UserController extends Controller
{
    public function store(Request $request)
    {
        $user = $request->input('user');
        Log::info('User data: '. $user);
        
        // rest of the code...
    }
}

In the above code, we have a store method in the UserController which is logging user data directly from the request without any sanitization or validation.

The line Log::info('User data: '. $user); is vulnerable to Log Injection attacks.

Any user-supplied data is inherently untrusted. In this case, the user data from the request is directly concatenated to the log entry string and then logged. An attacker could provide malicious input containing characters or sequences that can manipulate the log file to either insert false entries, modify existing ones, or even corrupt the log file altogether.

This can lead to a range of problems from incorrect system behavior and decision making based on false log data, to disclosure of sensitive information, or even execution of arbitrary code depending on the logging system's processing and interpretation of the corrupted log data.

Steps​

  • Validate the user input to ensure it is in the expected format and does not contain any malicious content.
  • Sanitize the user input to remove any potentially harmful data before logging it.
  • Escape any special characters in the user input to prevent them from being interpreted in a way that could lead to log injection.
  • Consider using structured logging, which automatically handles the safe encoding of user input.

Compliant code​

<?php

namespace App\\Http\\Controllers;

use Illuminate\\Http\\Request;
use Log;
use Illuminate\\Support\\Facades\\Validator;

class UserController extends Controller
{
    public function store(Request $request)
    {
        $validator = Validator::make($request->all(), [
            'user' => 'required|string',
        ]);

        if ($validator->fails()) {
            return response()->json($validator->errors(), 400);
        }

        $user = htmlspecialchars($request->input('user'));
        Log::info('User data: '. $user);
        
        // rest of the code...
    }
}

The updated code now includes validation, sanitization, and escaping of the user input before it is logged.

  1. Validation: The Validator::make function is used to validate the user input. It checks if the 'user' input is present and is a string. If the validation fails, it returns a JSON response with the validation errors and a 400 status code.

  2. Sanitization: The htmlspecialchars function is used to sanitize the user input. It converts special characters to their HTML entities. This prevents these characters from being interpreted in a harmful way.

  3. Escaping: The htmlspecialchars function also serves to escape the user input. It ensures that any special characters in the user input are not interpreted as part of the log entry.

By implementing these measures, the risk of log injection is significantly reduced. The system now properly handles user input before logging it, ensuring that the logs are safe and reliable.

References​

Last updated on