Logging Failures

Logging & Alerting Failures (OWASP A09)

Purpose

Provide detection patterns for logging vulnerabilities including log injection, insufficient logging of security events, secrets in logs, and log tampering vulnerabilities.

OWASP Top 10 Mapping

Category: A09 - Security Logging & Alerting Failures

CWEs:

• CWE-117: Improper Output Neutralization for Logs
• CWE-223: Omission of Security-Relevant Information
• CWE-532: Insertion of Sensitive Information into Log File
• CWE-778: Insufficient Logging

When to Use

Activate this skill when:

• Reviewing logging implementations
• Checking for log injection vulnerabilities
• Auditing security event logging
• Looking for secrets exposed in logs
• Verifying audit trail completeness

---

Log Injection (CWE-117)

Overview

Log injection occurs when user-controlled input is written to logs without sanitization, allowing attackers to inject fake log entries or manipulate log output.

Detection Patterns

Python

# String concatenation in logs
grep -rniE "logging\.(info|debug|error|warn).*\+|logger\.(info|debug|error|warn).*\+" --include="*.py"

# f-string/format in logs with user input
grep -rniE "logging\.(info|debug|error|warn).*f['\"]|logger\..*\.format\(" --include="*.py"

Vulnerable:

# VULNERABLE: User input directly in log
logger.info(f"User login: {request.form['username']}")  # Can inject newlines

Secure:

# SAFE: Structured logging
logger.info("User login", extra={"username": sanitize(username)})

Java

# String concatenation in logs
grep -rniE "log\.(info|debug|error|warn).*\+|logger\.(info|debug|error|warn).*\+" --include="*.java"

# Format with user input
grep -rniE "String\.format.*log|log.*String\.format" --include="*.java"

Vulnerable:

// VULNERABLE: Direct concatenation
logger.info("User login: " + username);  // Can inject newlines

Secure:

// SAFE: Parameterized logging
logger.info("User login: {}", sanitize(username));