Need

Secure logging and information handling

Context

• Usage of Scala for functional and object-oriented programming on the JVM
• Usage of play.api.Logger for logging in a Play Framework application

Description

Non compliant code

        import play.api.Logger

class VulnerableService {
  def someFunction() = {
    Logger.info("This is an info message")
    Logger.warn("This is a warning message")
    Logger.debug("This is a debug message")

    // Some business logic here
  }
}
        
        

The code above represents a Scala backend application using the Play Framework. In the VulnerableService class, there is a method named someFunction. This method uses the Logger class from the Play API to log various messages.

The issue resides in the usage of Logger.info, Logger.warn, and Logger.debug methods. These methods are used to log messages at different levels of severity, and they can be extremely useful during the development and debugging stages.

However, in a production environment, these log messages can lead to technical information leaks. They may reveal details about the internal workings of the application, such as the methods being used, the technologies in place, and the logic behind certain operations.

For instance, if an attacker gains access to these logs, they could potentially use this information to exploit vulnerabilities in the application. Therefore, it is recommended to avoid using such logging methods in a production environment or ensure that the logs are appropriately protected and monitored.

Steps

• Remove or comment out the usage of console functions (log, info, warning) in production code.
• Implement a proper logging framework that supports different log levels and log outputs.
• Configure the logging framework to log only necessary information and avoid sensitive data leakage.
• Ensure that the logging framework is properly integrated with the application's error handling and exception reporting mechanisms.
• Regularly review and update the logging configuration to meet the changing requirements and security standards.

Compliant code

        import play.api.Logger
import play.api.{Logger, Mode}
import play.api.Play.current

class VulnerableService {
  def someFunction() = {
    if (current.mode != Mode.Prod) {
      Logger.info("This is an info message")
      Logger.warn("This is a warning message")
      Logger.debug("This is a debug message")
    }

    // Some business logic here
  }
}
        
        

The updated code now checks if the application is running in production mode before logging any information. If the application is not in production mode, it will log the information as before. However, if the application is in production mode, it will not log any information, thus preventing potential information leakage.

This is a simple and effective way to prevent information leakage through logging in a production environment. However, it is recommended to use a more sophisticated logging framework that supports different log levels and log outputs. This would allow you to control what information is logged and where it is logged to, providing a more granular control over your application's logging.

In addition, it is important to regularly review and update your logging configuration to ensure that it meets your changing requirements and security standards. This includes ensuring that your logging framework is properly integrated with your application's error handling and exception reporting mechanisms, and that it does not log sensitive data.

References

• 066. Technical information leak - Console functions