CAPEC Definitions / CAPEC-81
CAPEC-81: Web Server Logs Tampering
Web Logs Tampering attacks involve an attacker injecting, deleting or otherwise tampering with the contents of web logs typically for the purposes of masking other malicious behavior. Additionally, writing malicious data to log files may target jobs, filters, reports, and other agents that process the logs in an asynchronous attack pattern. This pattern of attack is similar to Log Injection-Tampering-Forging except that in this case, the attack is targeting the logs of the web server and not the application.
Extended Description
No Extended Description.
Mitigations
Design: Use input validation before writing to web log
Design: Validate all log data before it is output
Relationships with other CAPECs
CAPEC-268: Audit Log Manipulation
Prerequisites
Target server software must be a HTTP server that performs web logging.
Related Weaknesses
CWE-117: Improper Output Neutralization for Logs
CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')
CWE-75: Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)
CWE-221: Information Loss or Omission
CWE-96: Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')
CWE-20: Improper Input Validation
CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences
CWE-276: Incorrect Default Permissions
CWE-279: Incorrect Execution-Assigned Permissions
CWE-116: Improper Encoding or Escaping of Output
