Skip to content

Commit 444b27f

Browse files
ckarandeckarande
authored
Merge pull request #108 from lirantal/feat/log-injection
feat(log-injection): example vulnerable code for CSRF injection
2 parents fa5b1f9 + 3d17f97 commit 444b27f

File tree

3 files changed

+113
-9
lines changed

3 files changed

+113
-9
lines changed

‎app/routes/session.js‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -61,6 +61,20 @@ function SessionHandler(db) {
6161
var invalidPasswordErrorMessage = "Invalid password";
6262
if (err) {
6363
if (err.noSuchUser) {
64+
console.log('Error: attempt to login with invalid user: ', userName);
65+
66+
// Fix for A1 - 3 Log Injection - encode/sanitize input for CRLF Injection
67+
// that could result in log forging:
68+
// - Step 1: Require a module that supports encoding
69+
// var ESAPI = require('node-esapi');
70+
// - Step 2: Encode the user input that will be logged in the correct context
71+
// following are a few examples:
72+
// console.log('Error: attempt to login with invalid user: %s', ESAPI.encoder().encodeForHTML(userName));
73+
// console.log('Error: attempt to login with invalid user: %s', ESAPI.encoder().encodeForJavaScript(userName));
74+
// console.log('Error: attempt to login with invalid user: %s', ESAPI.encoder().encodeForURL(userName));
75+
// or if you know that this is a CRLF vulnerability you can target this specifically as follows:
76+
// console.log('Error: attempt to login with invalid user: %s', userName.replace(/(\r\n|\r|\n)/g, '_'));
77+
6478
return res.render("login", {
6579
userName: userName,
6680
password: "",

‎app/views/tutorial/a1.html‎

Lines changed: 98 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -21,15 +21,15 @@ <h3 class="panel-title">Description</h3>
2121
Injection flaws occur when untrusted data is sent to an interpreter as part of a command or query. The attacker’s hostile data can trick the interpreter into executing unintended commands or accessing data without proper authorization.
2222
</div>
2323
</div>
24-
<!--
25-
<div class="panel panel-info">
26-
<div class="panel-heading">
27-
<h3 class="panel-title">Real World Attack Incident Examples</h3>
28-
</div>
29-
<div class="panel-body">
30-
Screencast here ...
31-
</div>
32-
</div>
24+
<!--
25+
<div class="panel panel-info">
26+
<div class="panel-heading">
27+
<h3 class="panel-title">Real World Attack Incident Examples</h3>
28+
</div>
29+
<div class="panel-body">
30+
Screencast here ...
31+
</div>
32+
</div>
3333
-->
3434
</div>
3535
</div>
@@ -308,6 +308,95 @@ <h3 class="panel-title">How Do I Prevent It?</h3>
308308
</div>
309309
</div>
310310
<!-- /NoSQL Injection -->
311+
312+
<!-- Log Injection -->
313+
<div class="panel panel-info">
314+
<div class="panel-heading">
315+
<h4 class="panel-title">
316+
<a data-toggle="collapse" data-parent="#accordion" href="#collapseTwo">
317+
<i class="fa fa-chevron-down"></i> A1 - 3 Log Injection
318+
</a>
319+
</h4>
320+
</div>
321+
<div id="collapseTwo" class="panel-collapse">
322+
<div class="panel-body">
323+
324+
325+
<div class="panel panel-default">
326+
<div class="panel-heading">
327+
<h3 class="panel-title">Description</h3>
328+
</div>
329+
<div class="panel-body">
330+
<p>
331+
Log injection vulnerabilities enable an attacker to forge and tamper with an application's logs.
332+
</p>
333+
</div>
334+
</div>
335+
336+
<div class="panel panel-default">
337+
<div class="panel-heading">
338+
<h3 class="panel-title">Attack Mechanics</h3>
339+
</div>
340+
<div class="panel-body">
341+
<p>An attacker may craft a malicious request that may deliberately fail, which the application will log, and when attacker's user input is unsanitized, the payload is sent as-is to the logging facility. Vulnerabilities may vary depending on the logging facility:</p>
342+
<h5>1. Log Forging (CRLF) </h5>
343+
<p>Lets consider an example where an application logs a failed attempt to login to the system. A very common example for this is as follows:
344+
</p>
345+
<pre>
346+
var userName = req.body.userName;
347+
console.log('Error: attempt to login with invalid user: ', userName);
348+
</pre>
349+
<p>When user input is unsanitized and the output mechanism is an ordinary terminal stdout facility then the application will be vulnerable to CRLF injection, where an attacker can create a malicious payload as follows:
350+
<pre>
351+
curl http://localhost:4000/login -X POST --data 'userName=vyva%0aError: alex moldovan failed $1,000,000 transaction&password=Admin_123&_csrf='
352+
</pre>
353+
Where the <code>userName</code> parameter is encoding in the request the LF symbol which will result in a new line to begin. Resulting log output will look as follows:
354+
<pre>
355+
Error: attempt to login with invalid user: vyva
356+
Error: alex moldovan failed $1,000,000 transaction
357+
</pre>
358+
<br/>
359+
<h5>2. Log Injection Escalation </h5>
360+
<p>
361+
An attacker may craft malicious input in hope of an escalated attack where the target isn't the logs themselves, but rather the actual logging system. For example, if an application has a back-office web app that manages viewing and tracking the logs, then an attacker may send an XSS payload into the log, which may not result in log forging on the log itself, but when viewed by a system administrator on the log viewing web app then it may compromise it and result in XSS injection that if the logs app is vulnerable.
362+
</p>
363+
364+
<div class="panel panel-default">
365+
<div class="panel-heading">
366+
<h3 class="panel-title">How Do I Prevent It?</h3>
367+
</div>
368+
<div class="panel-body">
369+
370+
As always when dealing with user input:
371+
<ul>
372+
<li>
373+
Do not allow user input into logs
374+
</li>
375+
<li>
376+
Encode to proper context, or sanitize user input
377+
</li>
378+
</ul>
379+
380+
Encoding example:
381+
<pre>
382+
// Step 1: Require a module that supports encoding
383+
var ESAPI = require('node-esapi');
384+
// - Step 2: Encode the user input that will be logged in the correct context
385+
// following are a few examples:
386+
console.log('Error: attempt to login with invalid user: %s', ESAPI.encoder().encodeForHTML(userName));
387+
console.log('Error: attempt to login with invalid user: %s', ESAPI.encoder().encodeForJavaScript(userName));
388+
console.log('Error: attempt to login with invalid user: %s', ESAPI.encoder().encodeForURL(userName));
389+
</pre>
390+
391+
For the above Log Injection vulnerability, example and fix can be found at
392+
<code>routes/session.js</code>
393+
</div>
394+
</div>
395+
</div>
396+
</div>
397+
</div>
398+
<!-- /Log Injection -->
399+
311400
</div>
312401
<!-- end accordions -->
313402
{% endblock %}

‎package.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@
1616
"helmet": "^2.0.0",
1717
"marked": "0.3.5",
1818
"mongodb": "^2.1.18",
19+
"node-esapi": "0.0.1",
1920
"serve-favicon": "^2.3.0",
2021
"swig": "^1.4.2",
2122
"underscore": "^1.8.3"

0 commit comments

Comments
 (0)