2

I'm updating an application to write slightly more verbose errors to the system log file (in this case, /var/log/apache2/mysite_error_log). I hope that I'm not asking the proverbial stupid question - but are there any potential issues with including user-passed data such as invalid arguments passed to a page in the Apache log file?

The log file is text and read/write to the web server, but I don't want to write potentially harmful text/data that could be exploited if the log file is subsequently opened/read via command line.

Improve this question

2 Answers 2

Reset to default
1

Yes. This data should be useful to help debug errors, however, there are at least a few (maybe more) potential security pitfalls to consider:

  • Is any of the data privacy sensitive (like social security numbers, passwords, addresses, etc...?) If so, there could be privacy concerns, but those most of those concerns should already exist with the website anyway.

  • Logging passwords would be exceptionally dangerous as it would be a plain-text storing of the user's password, which is very bad. If an attacker would be able to open the log file, he could look then look at all passwords entered! On this point, an administrator could also look at the user's password, which is not supposed to happen (because the administrator could then impersonate the user), so I would highly recommend not logging the content of passwords.

  • Are the files adequately protected? They should only be accessible by administrators. The system needs to be patched consistently to deter potential attackers from elevating their privilege to root to read the data.

Improve this answer
3
  • Points: no, n/a*, yes. *if someone accidentally types a password in a name box, I can't help that. I mainly want to avoid any kind of injection attack. I'm leaning toward not logging this data.. because of the unknown.
    – a coder
    Commented Nov 7, 2014 at 19:05
  • I changed my answer to "yes", there are pitfalls. However, even with these pitfalls, I would recommending data (but not log passwords). You would do good to test your interface thoroughly against injection attacks (there are tools to help do this).
    – Jonathan
    Commented Nov 7, 2014 at 19:15
  • pentest is what prompted this post. :)
    – a coder
    Commented Nov 7, 2014 at 20:39
1

Don't write directly the files! Use a logging service (or in the case of the Apache error_log just print into the stderr). And make sure that the logs are outside the document root - if the webserver can be fooled into serving them up as PHP files then you have a major code injection vulnerability.

if the log file is subsequently opened/read via command line.

That's a tricky one. Opened with what? Transforming the output with (for example) htmlentities should reduce the attack surface a bit, but I suspect we're heading into tin-foil hat security here.

Improve this answer
1
  • Right now (not passing any user data) I'm using PHP's error_log(). I only view the log files with tail, more, ect. I do not use a log file analyzer that displays content in a browser.
    – a coder
    Commented Nov 8, 2014 at 11:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .