Home / Knowledge hub / Log injection
Knowledge hub
Log injection
Input that forges or hides log entries by smuggling in new lines.
What it means
Log injection happens when your application writes user input into a log without cleaning it. If the input contains a line break, the attacker can end the real entry and add a made-up one that looks as though your system wrote it.
Logs are meant to be a trusted record of what happened. Once outsiders can write lines into them, that record can be edited by the people you most need it to be accurate about. The same weakness lets someone hide their own tracks by pushing a real line out of sight.
Why it matters
During an incident, the log is the evidence. Forged lines can blame someone else, show a successful sign-in that never happened, or bury a real event in noise. MITRE tracks the weakness as CWE-117, and the effect on a response can be hours of wasted effort.
There is a second danger. If logs are shown in a web page or a viewer that does not escape them, a log line can carry a script, so simply reading your own logs can put your own staff at risk.
How it shows up
You meet it wherever a request detail is logged: usernames on failed sign-ins, user agent strings, search terms, file names and error messages that echo input. The common mistake is concatenating raw values into a line of text, which lets embedded line breaks, or separators your parser relies on, change its meaning.
Use structured logging, such as JSON, so each value stays in its own field. Encode or remove carriage return and line feed characters, limit the length, and escape output in log viewers. Treat log contents as untrusted when reading them. See logging and monitoring and CRLF injection.
Questions people ask
Log injection, answered
What is the difference between log injection and log forging?
They describe the same weakness. Forging is the effect, the creation of fake entries. Injection is the cause, input that changes the log's structure.
Both are covered by the same fix.
Is log injection serious?
On its own it harms the integrity of your records rather than your data. Its seriousness depends on how much you rely on logs for detection and investigation.
If logs feed alerts or audits, it matters a great deal.
How does structured logging help?
Each value sits in its own field, so a line break inside a value cannot pretend to be a new entry. JSON encoding handles the escaping.
It also makes the logs easier to search.
Can log injection lead to XSS?
Yes, if a log viewer shows entries as raw HTML. A script in a logged value then runs in the browser of whoever reads it.
Escape output in any tool that displays logs.
How do we test for log injection?
Submit a recognisable marker with encoded line breaks in fields you expect to be logged, then check the log for a separate line.
Do this in a test environment or with an agreed marker.
Sources
Where this comes from
Related
Terms that sit next to this one
Logging and monitoring
Recording what happens, and actually watching what gets recorded.
Audit log
A record of who did what and when, kept so you can answer later.
CRLF injection
Using carriage return and line feed characters to split a response or a log line.
Incident response
The agreed plan for the hours after something has gone wrong.
SIEM
A system that gathers logs from everywhere and raises alerts on suspicious patterns.
Can outsiders write in your logs?
Logs only help if outsiders cannot write in them. We check which inputs end up in logs and report what we proved, with the request that planted the line. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.