Log injection
Untrusted input written to a log forges entries, breaks log parsers, or injects markup or lookup expressions into the tools that read the log (CWE-117). Encode CR, LF and delimiters and log structured fields; Log4Shell showed the danger of a logging library that interprets the messages it logs.
- Also called
- log forging
- Fix it in your stack
- CRLF injection in logs and response headers fix cards (3 stacks) · CWE-117 page
- Defined in
- MITRE CWE-117
- Identifiers
- CWE-117: Log injection
Covered in
Guide
Prevent CRLF header injection, log forging and CSV formula injection
Carriage return and line feed separate HTTP header fields, log records and CSV rows, and a leading = turns a spreadsheet cell into a formula. Let the framework write headers, log structured JSON, and neutralize formula triggers in exports.
Guide
Create security logs someone can investigate
Record meaningful decisions with consistent structure, protect the resulting evidence, and prove that important events reach an operational owner.