robert.bean (Community Member) asked a question.
Acceptable mitigation for CWE 117 (Improper Output Neutralization for Logs)?
Our devs have proposed the following mitigation for a large number of CWE 117 flaws:
"We have analyzed CRLF and it's false positive, since we use SEQ as log sink in Serilog. The vulnerability can occur if you log to a file, for instance, where CRLF is used to separate log entries."
I have zero development experience so I don't know SEQ works the way they say it will and is an appropriate mitigation. Is it acceptable or should I push back for more info/better mitigation?
.png){kind=logo}
Hello @robert.bean (Community Member),
Thank you for your question. I understand SEQ (https://datalust.co/seq) to be a technology that can collect and report on structured application logs, similar to how one may expect with Elasticsearch and Kibana. I assume the team are using something like this library Serilog.Sinks.Seq (https://github.com/serilog/serilog-sinks-seq) to achieve that integration.
The important thing here is to ask the team to attest in the mitigation proposal that the logs are not being written to a file or other medium which would be vulnerable to CWE-117. In this case it seems the data is being sent to SEQ as JSON therefore the mitigation proposal is reasonable since CRLF characters would not result in new log entries being entered.
I hope that answers your question.
Kind regards,
Anthony Fielding