Need

Prevention of log injection attacks

Context

• Usage of C# for building robust and scalable applications
• Usage of Microsoft.AspNetCore.Mvc for building web applications with ASP.NET Core
• Usage of System.IO for input/output operations in .NET development

Description

Non compliant code

        using Microsoft.AspNetCore.Mvc;
using System.IO;

public class LogController : Controller
{
    [HttpGet]
    public IActionResult LogData(string logData)
    {
        using (StreamWriter sw = new StreamWriter("log.txt", true))
        {
            sw.WriteLine(logData);
        }
        return Ok();
    }
}
        
        

In the above code, the LogData method in the LogController class takes a string parameter logData from the user and directly writes it into a log file. This is done using the StreamWriter class's WriteLine method.

The vulnerability here is that the input from the user ( logData) is not validated, sanitized, or escaped before it is written to the log file. This means that if an attacker provides input that contains malicious code or commands, it would be directly written into the log file. This is a log injection vulnerability.

For example, an attacker could provide input that includes newline characters ( \\n) followed by fake log entries, which could mislead anyone reviewing the logs. In a more severe scenario, if the log files are processed by a system that executes commands in the logs, the attacker could inject harmful commands through this vulnerability.

This vulnerability could be exploited to perform various attacks such as data manipulation, data corruption, or even system takeover depending on the environment and the way logs are processed.

Steps

• Validate and sanitize the input data before logging it.
• Use parameterized queries or prepared statements to prevent log injection.
• Implement proper input validation and filtering to ensure that only safe characters are logged.
• Escape special characters in the input data to prevent them from being interpreted as log formatting directives.
• Consider using a logging library or framework that handles input validation and sanitization automatically.

Compliant code

        using Microsoft.AspNetCore.Mvc;
using System.IO;
using System.Text.Encodings.Web;

public class LogController : Controller
{
    private readonly HtmlEncoder _htmlEncoder;

    public LogController(HtmlEncoder htmlEncoder)
    {
        _htmlEncoder = htmlEncoder;
    }

    [HttpGet]
    public IActionResult LogData(string logData)
    {
        string sanitizedLogData = _htmlEncoder.Encode(logData);

        using (StreamWriter sw = new StreamWriter("log.txt", true))
        {
            sw.WriteLine(sanitizedLogData);
        }
        return Ok();
    }
}
        
        

The original code was vulnerable to log injection attacks because it directly wrote user-provided data to a log file without any validation or sanitization. This could allow an attacker to inject malicious content into the log file, potentially leading to a variety of attacks such as data corruption, information disclosure, or even remote code execution.

The fixed code mitigates this vulnerability by using the HtmlEncoder.Encode method to sanitize the user-provided data before writing it to the log file. This method encodes special characters in the input string, preventing them from being interpreted as log formatting directives or other potentially harmful content.

The HtmlEncoder instance is provided to the LogController through dependency injection, which is a common practice in ASP.NET Core applications. This allows the encoding behavior to be configured globally for the application, ensuring consistent sanitization of user-provided data throughout the application.

In addition to this, it's recommended to use a logging library or framework that automatically handles input validation and sanitization, to further reduce the risk of log injection and other similar vulnerabilities.

References

• 091. Log injection