/logging-failures

name: Logging Failures
description: This skill should be used when the user asks about "logging failures", "log injection", "insufficient logging", "audit logging", "security logging", "CWE-117", or needs to find logging-related vulnerabilities during whitebox security review.
version: 1.0.0

Logging & Alerting Failures (OWASP A09)

Purpose

Provide detection patterns for logging vulnerabilities including log injection, insufficient logging of security events, secrets in logs, and log tampering vulnerabilities.

OWASP Top 10 Mapping

**Category**: A09 - Security Logging & Alerting Failures

**CWEs**:

• CWE-117: Improper Output Neutralization for Logs
• CWE-223: Omission of Security-Relevant Information
• CWE-532: Insertion of Sensitive Information into Log File
• CWE-778: Insufficient Logging

When to Use

Activate this skill when:

• Reviewing logging implementations
• Checking for log injection vulnerabilities
• Auditing security event logging
• Looking for secrets exposed in logs
• Verifying audit trail completeness

---

Log Injection (CWE-117)

Overview

Log injection occurs when user-controlled input is written to logs without sanitization, allowing attackers to inject fake log entries or manipulate log output.

Detection Patterns

Python

# String concatenation in logs
grep -rniE "logging\.(info|debug|error|warn).*\+|logger\.(info|debug|error|warn).*\+" --include="*.py"

# f-string/format in logs with user input
grep -rniE "logging\.(info|debug|error|warn).*f['\"]|logger\..*\.format\(" --include="*.py"

**Vulnerable**:

# VULNERABLE: User input directly in log
logger.info(f"User login: {request.form['username']}")  # Can inject newlines

**Secure**:

# SAFE: Structured logging
logger.info("User login", extra={"username": sanitize(username)})

Java

# String concatenation in logs
grep -rniE "log\.(info|debug|error|warn).*\+|logger\.(info|debug|error|warn).*\+" --include="*.java"

# Format with user input
grep -rniE "String\.format.*log|log.*String\.format" --include="*.java"

**Vulnerable**:

// VULNERABLE: Direct concatenation
logger.info("User login: " + username);  // Can inject newlines

**Secure**:

// SAFE: Parameterized logging
logger.info("User login: {}", sanitize(username));

Go

# Printf-style logging with user input
grep -rniE "log\.Printf|log\.Print.*\+" --include="*.go"

# Zap/logrus with user input
grep -rniE "zap\.String.*request|logrus\.WithField.*request" --include="*.go"

**Vulnerable**:

// VULNERABLE: Direct formatting
log.Printf("User login: %s", userInput)  // Can inject newlines

**Secure**:

// SAFE: Structured logging
logger.Info("user login", zap.String("username", sanitize(username)))

TypeScript

# Console/logger with concatenation
grep -rniE "console\.(log|info|error|warn).*\+|logger\.(log|info|error|warn).*\+" --include="*.ts"

PHP

# error_log with user input
grep -rniE "error_log.*\$_|syslog.*\$_|log.*\$_(GET|POST|REQUEST)" --include="*.php"

Log Injection Payloads

# Inject fake log entry
username: legitimate_user\n[ERROR] Admin password changed by attacker

# Inject multiple lines
input: line1\n[INFO] Fake entry\n[DEBUG] More fake entries

# ANSI escape codes (terminal injection)
input: \x1b[2J\x1b[1;1H  # Clear terminal

---

Insufficient Logging (CWE-778)

Overview

Missing logs for security-critical events prevents detection of attacks and incident response.

Events That MUST Be Logged

| Event Category | Specific Events | |----------------|-----------------| | **Authentication** | Login success/failure, logout, password change | | **Authorization** | Access denied, privilege escalation attempts | | **Input Validation** | Rejected/suspicious input | | **Session** | Session creation, destruction, timeout | | **Data Access** | Sensitive data read/write/delete | | **Configuration** | Settings changes, feature toggles | | **Errors** | Exceptions, failures (without stack traces) |

Detection Patterns

# Find auth functions without logging
grep -rniE "def (login|authenticate|authorize|check_permission)" --include="*.py" -A 10 | grep -v "log\."

# Find exception handlers without logging
grep -rniE "except.*:|catch\s*\(" --include="*.py" --include="*.java" -A 5 | grep -v "log\|logger"

# Find permission checks without logging
grep -rniE "has_permission|is_admin|check_role" --include="*.go" --include="*.py" --include="*.java" -A 5 | grep -v "log"

What to Check

# Authentication logging
grep -rniE "login|authenticate|logout" --include="*.go" --include="*.py" --include="*.java" --include="*.ts" --include="*.php" | xargs -I {} sh -c 'grep -l "log" {} || echo "MISSING: {}"'

# Failed access logging
grep -rniE "forbidden|unauthorized|access.*denied" --include="*.go" --include="*.py" --include="*.java" --include="*.ts" --include="*.php"

# Data modification logging
grep -rniE "delete|update|insert" --include="*.go" --include="*.py" --include="*.java" --include="*.ts" --include="*.php" | xargs -I {} sh -c 'grep -l "log\|audit" {} || echo "MISSING: {}"'

---

Secrets in Logs (CWE-532)

Overview

Logging sensitive data (passwords, tokens, API keys) exposes them to anyone with log access.

Detection Patterns

# Password in logs
grep -rniE "log.*(password|passwd|pwd|secret|token|api_key|apikey|credential)" --include="*.go" --include="*.py" --include="*.java" --include="*.ts" --include="*.php"

# Request body logging (may contain secrets)
grep -rniE "log.*request\.body|log.*req\.body|log.*getBody" --include="*.go" --include="*.py" --include="*.java" --include="*.ts" --include="*.php"

# Full object logging
grep -rniE "log.*user\)|log.*%v.*user|log.*JSON\.stringify" --include="*.go" --include="*.py" --include="*.java" --include="*.ts" --include="*.php"

Sensitive Fields to Never Log

• `password`, `passwd`,