Improper Neutralization of CRLF Sequences ('CRLF Injection')

ID

scala.inject.scala_inject_rule_clrfinjectionlogs

Severity

high

Remediation Complexity

medium

Remediation Risk

medium

Remediation Effort

medium

Resource

Inject

Language

Scala

Description

When data from an untrusted source is put into a logger and not neutralized correctly, an attacker could forge log entries or include malicious content. Inserted false entries could be used to skew statistics, distract the administrator or even to implicate another party in the commission of a malicious act. If the log file is processed automatically, the attacker can render the file unusable by corrupting the format of the file or injecting unexpected characters. An attacker may also inject code or other commands into the log file and take advantage of a vulnerability in the log processing utility (e.g. command injection or XSS).

Rationale

When data from an untrusted source is put into a logger and not neutralized correctly, an attacker could forge log entries or include malicious content. Inserted false entries could be used to skew statistics, distract the administrator or even to implicate another party in the commission of a malicious act. If the log file is processed automatically, the attacker can render the file unusable by corrupting the format of the file or injecting unexpected characters. An attacker may also inject code or other commands into the log file and take advantage of a vulnerability in the log processing utility (e.g. command injection or XSS).

The following code illustrates a vulnerable pattern detected by this rule:

// A newline in a logged value starts what reads as a new log record, so the caller can
// forge entries. Every argument that reaches the log is a place for one.
class RequestLog {
  def throughJavaUtilLogging(request: HttpServletRequest): Unit = {
    val supplied = request.getParameter("note")
    val fixed = "fixed"
    val logger = Logger.getLogger(classOf[Nothing].getName)
    logger.setLevel(Level.ALL)
    val console = new ConsoleHandler
    console.setLevel(Level.ALL)
    logger.addHandler(console)

    // VULNERABLE: Improper Neutralization of CRLF Sequences ('CRLF Injection')
    logger.config(supplied)
    // VULNERABLE: Improper Neutralization of CRLF Sequences ('CRLF Injection')
    logger.entering(supplied, fixed)
    // VULNERABLE: Improper Neutralization of CRLF Sequences ('CRLF Injection')
    logger.entering("fixed", fixed, supplied)
    // VULNERABLE: Improper Neutralization of CRLF Sequences ('CRLF Injection')
    logger.entering(fixed, "fixed", Array[String](supplied))
    // VULNERABLE: Improper Neutralization of CRLF Sequences ('CRLF Injection')
    logger.exiting(fixed, supplied)
    // VULNERABLE: Improper Neutralization of CRLF Sequences ('CRLF Injection')
    logger.exiting(fixed, "fixed", supplied)
    // VULNERABLE: Improper Neutralization of CRLF Sequences ('CRLF Injection')
    logger.fine(supplied)
    // VULNERABLE: Improper Neutralization of CRLF Sequences ('CRLF Injection')
    logger.finer(supplied.trim)
    // VULNERABLE: Improper Neutralization of CRLF Sequences ('CRLF Injection')
    logger.finest(supplied)
    // VULNERABLE: Improper Neutralization of CRLF Sequences ('CRLF Injection')
    logger.info(supplied)
    // VULNERABLE: Improper Neutralization of CRLF Sequences ('CRLF Injection')
    logger.log(Level.INFO, supplied)
    // VULNERABLE: Improper Neutralization of CRLF Sequences ('CRLF Injection')
    logger.log(Level.INFO, supplied, fixed)
    // VULNERABLE: Improper Neutralization of CRLF Sequences ('CRLF Injection')
    logger.log(Level.INFO, "fixed", Array[String](supplied))
    // VULNERABLE: Improper Neutralization of CRLF Sequences ('CRLF Injection')
    logger.log(Level.INFO, supplied)
    // VULNERABLE: Improper Neutralization of CRLF Sequences ('CRLF Injection')
    logger.logp(Level.INFO, supplied, fixed, "fixed")
    // VULNERABLE: Improper Neutralization of CRLF Sequences ('CRLF Injection')
    logger.logp(Level.INFO, fixed, "fixed", supplied, fixed)
    // VULNERABLE: Improper Neutralization of CRLF Sequences ('CRLF Injection')
    logger.logp(Level.INFO, "fixed", fixed.toLowerCase, fixed, Array[String](supplied))
    // VULNERABLE: Improper Neutralization of CRLF Sequences ('CRLF Injection')
    logger.logrb(Level.INFO, supplied, "fixed", "bundle", fixed, Array[String](fixed))
    // VULNERABLE: Improper Neutralization of CRLF Sequences ('CRLF Injection')
    logger.severe(supplied + "fixed" + fixed)

    // Removing only the line feed leaves the carriage return, which splits just as well.
    // VULNERABLE: Improper Neutralization of CRLF Sequences ('CRLF Injection')
    logger.warning(supplied.replaceAll("\n", ""))

    logger.fine(fixed)
    logger.log(Level.INFO, "fixed".toUpperCase, fixed + fixed)
    logger.logp(Level.INFO, fixed, fixed, fixed, Array[String](fixed))
    // The bundle name is an argument too.
    // VULNERABLE: Improper Neutralization of CRLF Sequences ('CRLF Injection')
    logger.logrb(Level.INFO, fixed, fixed, supplied + "bundle", fixed)

    // VULNERABLE: Improper Neutralization of CRLF Sequences ('CRLF Injection')
    logger.info(supplied.replace('\n', ' ').replace('\r', ' '))
    var cleaned = supplied.replace("\r", "").toUpperCase
    cleaned = "fixed" + cleaned.toLowerCase
    // Putting the line feed back after removing it undoes the removal.
    // VULNERABLE: Improper Neutralization of CRLF Sequences ('CRLF Injection')
    logger.warning(cleaned.replace("\n", " (new line)"))

    logger.fine(supplied.replaceAll("[\r\n]+", ""))
  }
}

Remediation

Follow secure coding practices and review the references below for detailed remediation guidance.

Configuration

This detector does not need any configuration.

References

© 2026 Xygeni. All rights reserved