CAPEC-81: Web Server Logs Tampering
Description
Web Logs Tampering attacks involve an attacker injecting, deleting or otherwise tampering with the contents of web logs typically for the purposes of masking other malicious behavior. Additionally, writing malicious data to log files may target jobs, filters, reports, and other agents that process the logs in an asynchronous attack pattern. This pattern of attack is similar to Log Injection-Tampering-Forging except that in this case, the attack is targeting the logs of the web server and not the application.
- Likelihood of attack
- Medium
- Typical severity
- High
- Abstraction
- DetailedA low-level, detailed pattern, often for a particular technology.
Mechanism of attack: Manipulate System Resources
Prerequisites
- Target server software must be a HTTP server that performs web logging.
Skills required
- LowTo input faked entries into Web logs
Consequences
- Integrity
Modify Data
Mitigations
- Design: Use input validation before writing to web log
- Design: Validate all log data before it is output
Related weaknesses (CWE)
- CWE-20Improper Input Validation
- CWE-75Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)
- CWE-93Improper Neutralization of CRLF Sequences ('CRLF Injection')
- CWE-96Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')
- CWE-116Improper Encoding or Escaping of Output
- CWE-117Improper Output Neutralization for Logs
- CWE-150Improper Neutralization of Escape, Meta, or Control Sequences
- CWE-221Information Loss or Omission
- CWE-276Incorrect Default Permissions
- CWE-279Incorrect Execution-Assigned Permissions