CWE-117
AllowedImproper Output Neutralization for Logs
Abstraction: Base · Status: Draft
The product constructs a log message from external input, but it does not neutralize or incorrectly neutralizes special elements when the message is written to a log file.
211 vulnerabilities reference this CWE, most recent first.
GHSA-678W-QRPP-9PJW
Vulnerability from github – Published: 2024-05-21 18:31 – Updated: 2024-07-03 18:42An issue was discovered in Italtel Embrace 1.6.4. The product does not neutralize or incorrectly neutralizes output that is written to logs. The web application writes logs using a GET query string parameter. This parameter can be modified by an attacker, so that every action he performs is attributed to a different user. This can be exploited without authentication.
{
"affected": [],
"aliases": [
"CVE-2024-31845"
],
"database_specific": {
"cwe_ids": [
"CWE-117"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-21T16:15:26Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in Italtel Embrace 1.6.4. The product does not neutralize or incorrectly neutralizes output that is written to logs. The web application writes logs using a GET query string parameter. This parameter can be modified by an attacker, so that every action he performs is attributed to a different user. This can be exploited without authentication.",
"id": "GHSA-678w-qrpp-9pjw",
"modified": "2024-07-03T18:42:58Z",
"published": "2024-05-21T18:31:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-31845"
},
{
"type": "WEB",
"url": "https://www.gruppotim.it/it/footer/red-team.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-68P3-H5C2-5HCR
Vulnerability from github – Published: 2025-08-22 21:31 – Updated: 2025-11-05 00:31Improper Output Neutralization for Logs vulnerability in Apache Log4cxx.
When using JSONLayout, not all payload bytes are properly escaped. If an attacker-supplied message contains certain non-printable characters, these will be passed along in the message and written out as part of the JSON message. This may prevent applications that consume these logs from correctly interpreting the information within them.
This issue affects Apache Log4cxx: before 1.5.0.
Users are recommended to upgrade to version 1.5.0, which fixes the issue.
{
"affected": [],
"aliases": [
"CVE-2025-54813"
],
"database_specific": {
"cwe_ids": [
"CWE-117"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-22T19:15:40Z",
"severity": "MODERATE"
},
"details": "Improper Output Neutralization for Logs vulnerability in Apache Log4cxx.\n\nWhen using JSONLayout, not all payload bytes are properly escaped. If an attacker-supplied message contains certain non-printable characters, these will be passed along in the message and written out as part of the JSON message. This may prevent applications that consume these logs from correctly interpreting the information within them.\n\nThis issue affects Apache Log4cxx: before 1.5.0.\n\nUsers are recommended to upgrade to version 1.5.0, which fixes the issue.",
"id": "GHSA-68p3-h5c2-5hcr",
"modified": "2025-11-05T00:31:25Z",
"published": "2025-08-22T21:31:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54813"
},
{
"type": "WEB",
"url": "https://github.com/apache/logging-log4cxx/pull/512"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00002.html"
},
{
"type": "WEB",
"url": "https://logging.apache.org/security.html#CVE-2025-54813"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2025/08/22/3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-6CJM-4PXW-7XP9
Vulnerability from github – Published: 2024-04-18 18:22 – Updated: 2025-09-15 20:06Impact
When authenticating as a superuser to a self-hosted Sentry instance with a username and password, the password is leaked as cleartext in logs under the event: auth-index.validate_superuser. An attacker with access to the log data could use these leaked credentials to login to the Sentry system as superuser.
Patches
- Self-hosted users on affected versions should upgrade to 24.4.1 or later.
- Sentry SaaS users do not need to take any action. This vulnerability is not applicable to SaaS.
Workarounds
Users can configure the logging level to exclude logs of the INFO level and only generate logs for levels at WARNING or higher. For details on configuring self-hosted Sentry's logging level see our documentation at: https://develop.sentry.dev/config/#logging
References
- Bug introduced in https://github.com/getsentry/sentry/pull/66393
- Security fix in https://github.com/getsentry/sentry/pull/69148
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "sentry"
},
"ranges": [
{
"events": [
{
"introduced": "24.3.0"
},
{
"fixed": "24.4.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-32474"
],
"database_specific": {
"cwe_ids": [
"CWE-117",
"CWE-312"
],
"github_reviewed": true,
"github_reviewed_at": "2024-04-18T18:22:42Z",
"nvd_published_at": "2024-04-18T20:15:17Z",
"severity": "HIGH"
},
"details": "### Impact\nWhen authenticating as a superuser to a self-hosted Sentry instance with a username and password, the password is leaked as cleartext in logs under the _event_: `auth-index.validate_superuser`. An attacker with access to the log data could use these leaked credentials to login to the Sentry system as superuser.\n\n### Patches\n- Self-hosted users on affected versions should upgrade to 24.4.1 or later.\n- Sentry SaaS users do not need to take any action. This vulnerability is not applicable to SaaS.\n\n### Workarounds\nUsers can configure the logging level to exclude logs of the `INFO` level and only generate logs for levels at `WARNING` or higher. For details on configuring self-hosted Sentry\u0027s logging level see our documentation at: https://develop.sentry.dev/config/#logging\n\n### References\n- Bug introduced in https://github.com/getsentry/sentry/pull/66393\n- Security fix in https://github.com/getsentry/sentry/pull/69148",
"id": "GHSA-6cjm-4pxw-7xp9",
"modified": "2025-09-15T20:06:42Z",
"published": "2024-04-18T18:22:42Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/getsentry/sentry/security/advisories/GHSA-6cjm-4pxw-7xp9"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-32474"
},
{
"type": "WEB",
"url": "https://github.com/getsentry/sentry/pull/66393"
},
{
"type": "WEB",
"url": "https://github.com/getsentry/sentry/pull/69148"
},
{
"type": "WEB",
"url": "https://github.com/getsentry/sentry/commit/d5b34568d9f1c41362ccb62141532a0a2169512f"
},
{
"type": "PACKAGE",
"url": "https://github.com/getsentry/sentry"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Sentry vulnerable to leaking superuser cleartext password in logs"
}
GHSA-6R52-JCM4-48GV
Vulnerability from github – Published: 2024-05-02 21:30 – Updated: 2024-06-21 21:33IBM Cognos Analytics 11.2.0 through 11.2.4 and 12.0.0 through 12.0.2 is vulnerable to injection attacks in application logging by not sanitizing user provided data. This could lead to further attacks against the system. IBM X-Force ID: 282956.
{
"affected": [],
"aliases": [
"CVE-2024-25047"
],
"database_specific": {
"cwe_ids": [
"CWE-117"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-02T21:16:11Z",
"severity": "HIGH"
},
"details": "IBM Cognos Analytics 11.2.0 through 11.2.4 and 12.0.0 through 12.0.2 is vulnerable to injection attacks in application logging by not sanitizing user provided data. This could lead to further attacks against the system. IBM X-Force ID: 282956.",
"id": "GHSA-6r52-jcm4-48gv",
"modified": "2024-06-21T21:33:58Z",
"published": "2024-05-02T21:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25047"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/282956"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20240621-0007"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7149874"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-6VM3-JJ99-7229
Vulnerability from github – Published: 2022-12-27 21:30 – Updated: 2023-01-10 15:56Gin is a HTTP web framework written in Go (Golang). Unsanitized input in the default logger in github.com/gin-gonic/gin before v1.6.0 allows remote attackers to inject arbitrary log lines.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/gin-gonic/gin"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.6.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-36567"
],
"database_specific": {
"cwe_ids": [
"CWE-116",
"CWE-117"
],
"github_reviewed": true,
"github_reviewed_at": "2022-12-30T00:56:53Z",
"nvd_published_at": "2022-12-27T21:15:00Z",
"severity": "HIGH"
},
"details": "Gin is a HTTP web framework written in Go (Golang). Unsanitized input in the default logger in github.com/gin-gonic/gin before v1.6.0 allows remote attackers to inject arbitrary log lines.",
"id": "GHSA-6vm3-jj99-7229",
"modified": "2023-01-10T15:56:22Z",
"published": "2022-12-27T21:30:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36567"
},
{
"type": "WEB",
"url": "https://github.com/gin-gonic/gin/pull/2237"
},
{
"type": "WEB",
"url": "https://github.com/gin-gonic/gin/commit/a71af9c144f9579f6dbe945341c1df37aaf09c0d"
},
{
"type": "PACKAGE",
"url": "https://github.com/gin-gonic/gin"
},
{
"type": "WEB",
"url": "https://pkg.go.dev/vuln/GO-2020-0001"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Gin\u0027s default logger allows unsanitized input that can allow remote attackers to inject arbitrary log lines"
}
GHSA-735X-M7JJ-QWVP
Vulnerability from github – Published: 2023-07-11 03:30 – Updated: 2024-04-04 05:54SAP NetWeaver AS for Java - versions ENGINEAPI 7.50, SERVERCORE 7.50, J2EE-APPS 7.50, allows an unauthenticated attacker to craft a request over the network which can result in unwarranted modifications to a system log without user interaction. There is no ability to view any information or any effect on availability.
{
"affected": [],
"aliases": [
"CVE-2023-31405"
],
"database_specific": {
"cwe_ids": [
"CWE-117"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-07-11T03:15:09Z",
"severity": "MODERATE"
},
"details": "SAP NetWeaver AS for Java - versions ENGINEAPI 7.50, SERVERCORE 7.50, J2EE-APPS 7.50, allows an unauthenticated attacker to craft a request over the network which can result in unwarranted modifications to a system log without user interaction. There is no ability to view any information or any effect on availability.\n\n",
"id": "GHSA-735x-m7jj-qwvp",
"modified": "2024-04-04T05:54:26Z",
"published": "2023-07-11T03:30:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-31405"
},
{
"type": "WEB",
"url": "https://me.sap.com/notes/3324732"
},
{
"type": "WEB",
"url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-772W-G99G-GJQJ
Vulnerability from github – Published: 2026-06-24 09:30 – Updated: 2026-06-24 09:30Improper output neutralization for logs vulnerability in upKeeper Solutions upKeeper Instant Privilege Access on Windows allows Log Injection-Tampering-Forging.
This issue affects upKeeper Instant Privilege Access: through 1.6.1.
{
"affected": [],
"aliases": [
"CVE-2026-10745"
],
"database_specific": {
"cwe_ids": [
"CWE-117"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-24T09:16:30Z",
"severity": "HIGH"
},
"details": "Improper output neutralization for logs vulnerability in upKeeper Solutions upKeeper Instant Privilege Access on Windows allows Log Injection-Tampering-Forging.\n\nThis issue affects upKeeper Instant Privilege Access: through 1.6.1.",
"id": "GHSA-772w-g99g-gjqj",
"modified": "2026-06-24T09:30:49Z",
"published": "2026-06-24T09:30:49Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10745"
},
{
"type": "WEB",
"url": "https://support.upkeeper.se/hc/en-us/articles/28408945088796-CVE-2026-10745-Improper-output-neutralization-for-logs"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-7856-G3GV-9WQ8
Vulnerability from github – Published: 2026-07-07 20:04 – Updated: 2026-07-07 20:04Summary
Domain names were written to the log without first being validated to contain allowed characters.
Impact
Depends on how the logs were used.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/tinfoil-factory/netfoil"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.3.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-117"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-07T20:04:22Z",
"nvd_published_at": null,
"severity": "LOW"
},
"details": "### Summary\nDomain names were written to the log without first being validated to contain allowed characters.\n\n### Impact\nDepends on how the logs were used.",
"id": "GHSA-7856-g3gv-9wq8",
"modified": "2026-07-07T20:04:22Z",
"published": "2026-07-07T20:04:22Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/tinfoil-factory/netfoil/security/advisories/GHSA-7856-g3gv-9wq8"
},
{
"type": "PACKAGE",
"url": "https://github.com/tinfoil-factory/netfoil"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "netfoil: Attacker controlled data written to logs"
}
GHSA-785X-QW4V-6872
Vulnerability from github – Published: 2022-02-09 22:00 – Updated: 2024-09-05 00:44An Improper Output Neutralization for Logs flaw was found in Ansible when using the uri module, where sensitive data is exposed to content and json output. This flaw allows an attacker to access the logs or outputs of performed tasks to read keys used in playbooks from other users within the uri module. The highest threat from this vulnerability is to data confidentiality.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "ansible"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.10.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-14330"
],
"database_specific": {
"cwe_ids": [
"CWE-116",
"CWE-117",
"CWE-532"
],
"github_reviewed": true,
"github_reviewed_at": "2021-04-05T16:14:01Z",
"nvd_published_at": "2020-09-11T18:15:00Z",
"severity": "MODERATE"
},
"details": "An Improper Output Neutralization for Logs flaw was found in Ansible when using the uri module, where sensitive data is exposed to content and json output. This flaw allows an attacker to access the logs or outputs of performed tasks to read keys used in playbooks from other users within the uri module. The highest threat from this vulnerability is to data confidentiality.",
"id": "GHSA-785x-qw4v-6872",
"modified": "2024-09-05T00:44:53Z",
"published": "2022-02-09T22:00:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14330"
},
{
"type": "WEB",
"url": "https://github.com/ansible/ansible/issues/68400"
},
{
"type": "WEB",
"url": "https://github.com/ansible/ansible/pull/69653"
},
{
"type": "WEB",
"url": "https://github.com/ansible/ansible/commit/e0f25a2b1f9e6c21f751ba0ed2dc2eee2152983e"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14330"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-785x-qw4v-6872"
},
{
"type": "PACKAGE",
"url": "https://github.com/ansible/ansible"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2020-3.yaml"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2021/dsa-4950"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Improper Output Neutralization and Improper Encoding or Escaping of Output for Logs in ansible"
}
GHSA-7C78-RM87-5673
Vulnerability from github – Published: 2025-07-31 14:04 – Updated: 2025-10-23 17:42I. Detailed Description:
This includes scenarios, screenshots, vulnerability reproduction methods. For account-related vulnerabilities, please provide test accounts. If the reproduction process is complex, you may record a video, upload it to Taopan, and attach the link.
-
Install ms-swift
pip install ms-swift -U -
Start web-ui
swift web-ui --lang en -
After startup, access through browser at http://localhost:7860/ to see the launched fine-tuning framework program
-
Fill in necessary parameters In the LLM Training interface, fill in required parameters including Model id, Dataset Code. The --output_dir can be filled arbitrarily as it will be modified later through packet capture
-
Click Begin to start training. Capture packets and modify the parameter corresponding to --output_dir
You can see the concatenated command being executed in the terminal where web-ui was started
- Wait for the program to run (testing shows it requires at least 5 minutes), and you can observe the effect of command execution creating files
II. Vulnerability Proof (Write POC here):
/tmp/xxx'; touch /tmp/inject_success_1; #
III. Fix Solution: 1. The swift.ui.llm_train.llm_train.LLMTrain#train() method should not directly concatenate parameters with commands after receiving commands from the frontend 2. The swift.ui.llm_train.llm_train.LLMTrain#train_local() method should not use os.system for execution, but should be changed to subprocess.run([cmd, arg1, arg2...]) format
Author
- Discovered by: TencentAISec
- Contact: security@tencent.com
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "ms-swift"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.7.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-41419"
],
"database_specific": {
"cwe_ids": [
"CWE-117"
],
"github_reviewed": true,
"github_reviewed_at": "2025-07-31T14:04:24Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "**I. Detailed Description:** \n\nThis includes scenarios, screenshots, vulnerability reproduction methods. For account-related vulnerabilities, please provide test accounts. If the reproduction process is complex, you may record a video, upload it to Taopan, and attach the link.\n\n1. Install ms-swift\n ```\n pip install ms-swift -U\n ```\n\n2. Start web-ui\n ```\n swift web-ui --lang en\n ```\n\n3. After startup, access through browser at [http://localhost:7860/](http://localhost:7860/) to see the launched fine-tuning framework program\n\n4. Fill in necessary parameters\n In the LLM Training interface, fill in required parameters including Model id, Dataset Code. The --output_dir can be filled arbitrarily as it will be modified later through packet capture\n\n5. Click Begin to start training. Capture packets and modify the parameter corresponding to --output_dir\n\n You can see the concatenated command being executed in the terminal where web-ui was started\n\n6. Wait for the program to run (testing shows it requires at least 5 minutes), and you can observe the effect of command execution creating files\n\n**II. Vulnerability Proof (Write POC here):**\n```\n/tmp/xxx\u0027; touch /tmp/inject_success_1; #\n```\n\n**III. Fix Solution:**\n1. The swift.ui.llm_train.llm_train.LLMTrain#train() method should not directly concatenate parameters with commands after receiving commands from the frontend\n2. The swift.ui.llm_train.llm_train.LLMTrain#train_local() method should not use os.system for execution, but should be changed to subprocess.run([cmd, arg1, arg2...]) format\n\n## Author\n\n* Discovered by: [TencentAISec](https://github.com/TencentAISec)\n* Contact: *[security@tencent.com](mailto:security@tencent.com)*",
"id": "GHSA-7c78-rm87-5673",
"modified": "2025-10-23T17:42:54Z",
"published": "2025-07-31T14:04:24Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/modelscope/ms-swift/security/advisories/GHSA-7c78-rm87-5673"
},
{
"type": "WEB",
"url": "https://github.com/modelscope/ms-swift/commit/32f09e9b0a44f19d44210e2b5b47c58ab01740e1"
},
{
"type": "PACKAGE",
"url": "https://github.com/modelscope/ms-swift"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
"type": "CVSS_V4"
}
],
"summary": "MS SWIFT WEB-UI RCE Vulnerability"
}
Mitigation MIT-5
Strategy: Input Validation
- Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
- Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
Mitigation MIT-30
Strategy: Output Encoding
Use and specify an output encoding that can be handled by the downstream component that is reading the output. Common encodings include ISO-8859-1, UTF-7, and UTF-8. When an encoding is not specified, a downstream component may choose a different encoding, either by assuming a default encoding or automatically inferring which encoding is being used, which can be erroneous. When the encodings are inconsistent, the downstream component might treat some character or byte sequences as special, even if they are not special in the original encoding. Attackers might then be able to exploit this discrepancy and conduct injection attacks; they even might be able to bypass protection mechanisms that assume the original encoding is also being used by the downstream component.
Mitigation MIT-20
Strategy: Input Validation
Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked.
CAPEC-268: Audit Log Manipulation
The attacker injects, manipulates, deletes, or forges malicious log entries into the log file, in an attempt to mislead an audit of the log file or cover tracks of an attack. Due to either insufficient access controls of the log files or the logging mechanism, the attacker is able to perform such actions.
CAPEC-81: Web Server Logs Tampering
Web Logs Tampering attacks involve an attacker injecting, deleting or otherwise tampering with the contents of web logs typically for the purposes of masking other malicious behavior. Additionally, writing malicious data to log files may target jobs, filters, reports, and other agents that process the logs in an asynchronous attack pattern. This pattern of attack is similar to "Log Injection-Tampering-Forging" except that in this case, the attack is targeting the logs of the web server and not the application.
CAPEC-93: Log Injection-Tampering-Forging
This attack targets the log files of the target host. The attacker injects, manipulates or forges malicious log entries in the log file, allowing them to mislead a log audit, cover traces of attack, or perform other malicious actions. The target host is not properly controlling log access. As a result tainted data is resulting in the log files leading to a failure in accountability, non-repudiation and incident forensics capability.