Fallos del tipo CWE-117

135 resultados

Injeção em logs (Log Injection)

O software escreve dados do usuário ou de fontes externas diretamente nos logs sem sanitização, permitindo que um atacante injete mensagens falsas, quebre a estrutura do log ou esconda evidências. Isso compromete a auditoria, facilita ataques de negação de serviço e pode levar a falsificação de registros de segurança.

Ejemplo

Um aplicativo web registra logins assim: `log.info("Usuário: " + username + " realizou login")`. Um atacante cria uma conta chamada `admin%0aUSUÁRIO AUTORIZADO: admin` e faz login, injetando uma linha fake no log que simula uma ação de administrador que nunca ocorreu.

Cómo mitigar

Sanitize sempre entradas de usuário antes de registrar (remova quebras de linha, caracteres de controle), use estrutura de logging estruturada (JSON, key-value) em vez de concatenação, e valide/filtre dados na origem. Implemente logs imutáveis ou com assinatura criptográfica para auditoria sensível.

CVE-2024-45808MEDIUMMalicious log injection via access logs in envoyEPSS 0.4%CVE-2025-11627MEDIUMSite Checkup AI Troubleshooting with Wizard and Tips for Each Issue <= 1.47 - Unauthenticated Log File PoisoningEPSS 0.3%CVE-2026-18148MEDIUMIBM i is Affected By Multiple Vulnerabilities in Navigator for iEPSS 0.3%CVE-2023-32712HIGHUnauthenticated Log Injection in Splunk EnterpriseEPSS 0.3%CVE-2026-5078MEDIUMmorgan vulnerable to Log Forging via unneutralized control characters in :remote-userEPSS 0.3%CVE-2025-59784MEDIUMLog Pollution - Control Characters Not EscapedEPSS 0.3%CVE-2026-109786MEDIUMIn fail2ban 0.10.5 through 1.1.1 before ddd879d, the sshd filter (config/filter.d/sshd.conf) accepts an "on <token>" suffix after the host aEPSS 0.3%CVE-2026-6494MEDIUMAap-mcp-server: aap mcp server: log injection allows social engineering attacks via unsanitized inputEPSS 0.3%CVE-2026-14350MEDIUMVulnerabilities exists in IBM Cloud Pak for Data SystemEPSS 0.3%CVE-2025-3942MEDIUMImproper Output Neutralization for LogsEPSS 0.3%CVE-2024-0690MEDIUMAnsible-core: possible information leak in tasks that ignore ansible_no_log configurationEPSS 0.3%CVE-2026-45565HIGHRoxy-WI: EscapedString validator skips its '..' block when stripping (root cause for several path-traversal/RCE vectors)EPSS 0.3%CVE-2024-22229LOW Dell Unity, versions prior to 5.4, contain a vulnerability whereby log messages can be spoofed by an authenticated attacker. An attacker coEPSS 0.3%CVE-2025-10217MEDIUMA vulnerability exists in Asset Suite for an authenticated user to manipulate the content of performance related log data or to inject craftEPSS 0.3%CVE-2025-66577MEDIUMcpp-httplib Untrusted HTTP Header Handling: X-Forwarded-For/X-Real-IP TrustEPSS 0.3%CVE-2025-36625MEDIUMLog Poisoning in NessusEPSS 0.3%CVE-2026-85290MEDIUMInvoicePlane: Log Injection via Unsanitized User Input in Cron Key Error LoggingEPSS 0.3%CVE-2025-23405MEDIUMDario Health USB-C Blood Glucose Monitoring System Starter Kit Android Application Improper Output Neutralization For LogsEPSS 0.3%CVE-2024-35150MEDIUMIBM Maximo Application Suite log manipulationEPSS 0.3%CVE-2025-25294MEDIUMEnvoy Gateway Log Injection VulnerabilityEPSS 0.3%