2. of Repudiation
An attacker can pass data through the log to attack a log reader, and there’s no documentation of what sort of validations are done.
|
Threat |
|
|
|
You are not sanitizing user-supplied data before logging it. So, an attacker can inject JavaScript into the logs so that when the logs are read from a browser-based log reader, the code that was stored in the log is executed. |
|
CAPEC |
CAPEC-592 - Stored XSS |
|
ASVS |
5.3 - Ensure output is being encoded and protection is in place against injection attacks. 7.3.1 - Verify that logs are being encoded to avoid Carriage Return Line Feed (CRLF) injection, stored Cross-Site Scripting (XSS), and other forms of log injection. |
|
CWE |
CWE-117 - Improper Output Neutralization... |
