| tiêu đề | master-nan sweet-cms None Improper Output Neutralization for Logs |
|---|
| Mô tả | Cause of vulnerability: In lines 58-62 of the file 'middleware/log.go', the log entry relies on a user-supplied value (' c.reequest '). If the values provided by the user contain special characters or malicious code, these values may be logged directly into the log, resulting in log injection attacks. Attackers may manipulate the content of logs by submitting specific requests, which may lead to security issues such as leakage of sensitive information and misuse of log files. This is a typical log injection vulnerability.
middleware/log.go line 57-65
```
zap.L().Info("用户访问日志:",
zap.String("uri", c.Request.URL.Path),
zap.String("method", c.Request.Method),
zap.Any("query", c.Request.URL.Query()),
zap.Any("body", c.Request.Body),
zap.Any("response", responseBody),
zap.String("ip", c.ClientIP()),
zap.String("duration", fmt.Sprintf("%.4f seconds", duration.Seconds())))
zap.L().Info("Access Log end")
```
|
|---|
| Nguồn | ⚠️ https://github.com/master-nan/sweet-cms/issues/3 |
|---|
| Người dùng | zihe (UID 56943) |
|---|
| Đệ trình | 27/08/2024 19:04 (cách đây 2 những năm) |
|---|
| Kiểm duyệt | 30/08/2024 07:37 (3 days later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 276209 [master-nan Sweet-CMS đến 5f441e022b8876f07cde709c77b5be6d2f262e3f middleware/log.go LogHandler nâng cao đặc quyền] |
|---|
| điểm | 20 |
|---|