6. of Repudiation I
An attacker can create a log entry without a timestamp (or no log entry is timestamped).
|
Threat |
|
|
|
You aren’t sanitizing CRLFs before writing data from untrusted sources to the logs. Using CRLF injection, an attacker can insert additional log lines by adding a new line before inserting some text they have generated to fake one or more additional log lines. |
|
CAPEC |
CAPEC-93 - Log Injection-Tampering-Forging |
|
ASVS |
5.3 - Ensure output is encoded and you’re protecting against injection attacks. 7.3.4 - Ensure clocks are synched with an atomic clock and are in the correct time zone. |
|
CWE |
CWE-93 - Improper Neutralization of CRLF Sequences (‘CRLF Injection’) |
...
