Log forging via unsanitized user input written to a log

ID

vbnet.inject.log_forging

Severity

high

Remediation Complexity

medium

Remediation Risk

medium

Remediation Effort

medium

Resource

Inject

Language

VB.NET

Description

User-controlled input is written to a log without neutralizing CR/LF characters, which may allow log forging (CWE-117): an attacker who injects %0d%0a can split a log record and forge additional entries, or inject markup that a log viewer renders. Strip or encode line breaks (e.g. Replace vbCr/vbLf) before logging, or log the value as a structured parameter rather than concatenating it into the message.

Rationale

User-controlled input is written to a log without neutralizing CR/LF characters, which may allow log forging (CWE-117): an attacker who injects %0d%0a can split a log record and forge additional entries, or inject markup that a log viewer renders. Strip or encode line breaks (e.g. Replace vbCr/vbLf) before logging, or log the value as a structured parameter rather than concatenating it into the message.

The following code illustrates a vulnerable pattern detected by this rule:

Public Sub LogQueryString()
    ' VULNERABLE: Log forging via unsanitized user input written to a log
    logger.LogInformation(Request.QueryString("user"))
End Sub

Remediation

Follow secure coding practices and review the references below for detailed remediation guidance.

Configuration

This detector does not need any configuration.

References