Log Injection

Also Known As

TL;DR

Explanation

Log injection lets an attacker craft input containing newlines to insert fake log entries — hiding their activity or framing innocent users. It can also be used to inject terminal escape sequences that exploit log-viewing tools. Sensitive data (passwords, tokens, credit card numbers) should never appear in logs at all. Safe logging strips newlines, limits length, strips HTML tags, and redacts sensitive field names.

Common Misconception

Why It Matters

Common Mistakes

• Logging raw $_SERVER['HTTP_USER_AGENT'] or referer strings that contain newlines and control characters.
• Not stripping or escaping newline characters from all values before writing to log files.
• Using log injection to create fake entries in security logs to obscure a breach.
• Including user-supplied email addresses or usernames in log output without sanitisation.

Code Examples

// User input written directly to log — attacker forges log entries
\$user = \$_GET['username'];
error_log("Login attempt for user: \$user");
// ?username=admin%0aINFO: Login successful for admin

// Sanitise newlines before logging user-supplied values
\$user = str_replace(["\r","\n","\t"], ' ', \$_GET['username'] ?? '');

// Better: structured logging — each field is JSON-encoded
\$logger->info('Login attempt', [
    'username' => \$user,   // newlines harmless inside JSON string
    'ip'       => \$request->ip(),
]);

References

• ↗ https://owasp.org/www-community/attacks/Log_Injection
• ↗ https://cwe.mitre.org/data/definitions/117.html

Tags

Related Terms