目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1336 元

100%
请我们喝杯咖啡

CWE-117 日志输出的转义处理不恰当 类漏洞列表 101

CWE-117 日志输出的转义处理不恰当 类弱点 101 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-117属于日志注入漏洞，指程序在记录日志时未对来自外部的输入进行适当的净化处理。攻击者通常利用此缺陷，通过构造包含换行符或特殊字符的恶意输入，强行插入伪造的日志条目，从而掩盖真实攻击痕迹或误导安全分析人员。开发者应避免直接将用户输入拼接至日志字符串，而应采用安全的日志API，并对输入数据进行严格的过滤、转义或验证，确保日志内容的完整性与可信度。

MITRE CWE 官方描述
CWE：CWE-117 日志输出中和不当 (Improper Output Neutralization for Logs) 英文：产品从外部输入构建日志消息，但在将消息写入日志文件时，未对特殊元素进行中和或中和不当。
常见影响 (1)
Integrity, Confidentiality, Availability, Non-Repudiation Modify Application Data, Hide Activities, Execute Unauthorized Code or Commands
Interpretation of the log files may be hindered or misdirected if an attacker can supply data to the application that is subsequently logged verbatim. In the most benign case, an attacker may be able to insert false entries into the log file by providing the application with input that includes appr…
缓解措施 (3)
Implementation Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range…
Implementation Use and specify an output encoding that can be handled by the downstream component that is reading the output. Common encodings include ISO-8859-1, UTF-7, and UTF-8. When an encoding is not specified, a downstream component may choose a different encoding, either by assuming a default encoding or automatically inferring which encoding is being used, which can be erroneous. When the encodings are i…
Implementation Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked.
代码示例 (1)
The following web application code attempts to read an integer value from a request object. If the parseInt call fails, then the input is logged with an error message indicating what happened.
String val = request.getParameter("val"); try { int value = Integer.parseInt(val); } catch (NumberFormatException) { log.info("Failed to parse val = " + val); } ...
Bad · Java
CVE ID 标题 CVSS 风险等级 Published
CVE-2021-20333 MongoDB Server 安全漏洞 — MongoDB Server 5.3 Medium 2021-07-23
CVE-2020-25646 Red Hat Ansible 安全漏洞 — Community Collections 7.5 High 2020-10-29
CVE-2020-11644 Secomea GateManager 和 SiteManager 安全漏洞 — GateManager 6.5 Medium 2020-10-15
CVE-2020-14332 Red Hat Ansible 日志信息泄露漏洞 — Ansible 5.5 Medium 2020-09-11
CVE-2020-4072 generator-jhipster-kotlin 安全漏洞 — jhipster-kotlin 5.3 Medium 2020-06-25
CVE-2019-14854 Red Hat OpenShift Container Platform 日志信息泄露漏洞 — library-go 6.5 - 2020-01-07
CVE-2019-14864 Ansible 日志信息泄露漏洞 — Ansible 6.5 - 2020-01-02
CVE-2019-10213 Red Hat OpenShift Container Platform 日志信息泄露漏洞 — openshift 6.5 - 2019-11-25
CVE-2019-14858 Red Hat Ansible Tower和Engine 日志信息泄露漏洞 — Ansible 5.5 - 2019-10-14
CVE-2019-14846 红帽 Ansible 日志信息泄露漏洞 — Ansible 7.1 - 2019-10-08
CVE-2018-10932 lldpd 缓冲区错误漏洞 — lldptool 7.5 - 2018-08-21

CWE-117（日志输出的转义处理不恰当） 是常见的弱点类别，本平台收录该类弱点关联的 101 条 CVE 漏洞。