1. Executive Summary & Scope
Log Injection occurs when an application writes untrusted user input directly into system log files without stripping carriage return (`\r`) and newline (`\n`) characters. Attackers inject fake log entries into the file to mislead security investigators or exploit vulnerabilities in SIEM log ingestion parsers.
Standard Classification
OWASP Standard: OWASP Top 10 • Mapping: CWE-117 • Target Architecture: Public Web Systems & APIs
2. Threat Model & Attack Vectors
An attacker sends a username containing `admin\n2026-09-27 [INFO] User admin authenticated successfully`, fabricating an audit trail that obscures their actual malicious actions.
3. Code Analysis & Remediation Playbook
Vulnerable Implementation Pattern
// VULNERABLE: Direct concatenation of user input into raw log file
$username = $_POST['username'];
// Attacker input contains "\r\n2026-09-27 [SECURITY] Payment authorized"
file_put_contents("/var/log/app.log", "Failed login for: " . $username . "\n", FILE_APPEND);
Hardened Defense-in-Depth Implementation
// REMEDIATED: Strip newlines and adopt structured JSON serialization
function sanitizeLogEntry(string $input): string {
// Strip CRLF control characters to prevent log forging
return preg_replace('/[\r\n\t]/', ' ', $input);
}
// Or use strictly formatted JSON logging (newlines within JSON strings are auto-escaped)
$logData = [
'event' => 'login_failed',
'input_user' => $username, // json_encode automatically escapes \r\n to \r\n characters
'timestamp' => time()
];
file_put_contents("/var/log/app.log", json_encode($logData) . "\n", FILE_APPEND);
4. Audit Verification Checklist & Pass Criteria
| Verification Phase | Audit Test Description | Mandatory Passing Criteria |
|---|---|---|
| CRLF Payload Injection | Submit username containing `test\r\nFAKE_LOG_ENTRY`. | Log file maintains single-line structure; newlines rendered as escaped characters. |
| SIEM Ingestion Test | Verify log ingestion pipeline parses entries correctly without breaking field schemas. | JSON log format parses seamlessly into Elastic / Splunk / CloudWatch. |
| Control Character Filtering | Audit log sanitizer for ANSI escape code injection (terminal injection). | All non-printable ASCII control characters stripped before writing. |
Advertisement
WE
WebOTG Application Security Directorate
Senior Security Auditor
WebOTG provides benchmark reference documentation, automated matrix evaluators, and security test harnesses for government digital platforms, WQMS architectures, and STQC compliance frameworks.