security-logging-alerting-failures

A09:2025 — Security Logging & Alerting Failures

OWASP rank: #9 (community-voted for third consecutive cycle)
Renamed in 2025: Added "Alerting" — logging without alerting provides minimal security value.
Stats: 5 CWEs, 723 CVEs, 3.91% average incidence rate
Coverage CWEs: CWE-778, CWE-117, CWE-532, CWE-223, CWE-390

---

What This Category Covers

Failure Type	Description
Insufficient Logging	Auditable events (logins, access control failures, validation errors) not logged
Log Injection	User input flows unescaped into log messages — enables log forgery
Sensitive Data in Logs	Passwords, tokens, PII, card numbers written to log output
Omission of Security-Relevant Info	Errors/warnings logged without context (IP, user, timestamp, action)
No Alerting	Logs exist but no thresholds, rules, or platform routes them to incident response

---

Audit Checklist — FastAPI & Flask

Work through each section systematically. For each item, note: PASS, FAIL, or NOT APPLICABLE.

1. Log Injection (CWE-117)

User-controlled input must never flow raw into log statements.

What to look for:

# VULNERABLE — newline injection, ANSI escape injection
logger.info(f"User logged in: {request.form['username']}")
logger.warning("Failed login for: " + username)

# SAFE — sanitize before logging
import re
safe_username = re.sub(r'[\r\n\x1b]', '_', username)
logger.info("Failed login for: %s", safe_username)

Checklist:

• No f-strings or + concatenation with raw request data in log calls
• Newlines (\r, \n) stripped from all user-supplied log values
• ANSI escape codes (\x1b[) stripped (prevent terminal injection)
• Structured logging used (JSON format) — field separation prevents injection by design

---

2. Sensitive Data in Logs (CWE-532)

Secrets must never appear in log output — even at DEBUG level.

Patterns to flag:

# VULNERABLE
logger.debug(f"Auth token: {token}")
logger.info(f"Processing payment for card: {card_number}")
app.logger.debug(request.json)         # May contain password field
print(f"Password reset for {email}, token={reset_token}")

# SAFE
logger.info("Auth token validated for user_id=%s", user_id)
logger.info("Payment processed for user_id=%s, last4=%s", user_id, card_number[-4:])