log4j2, CWE 117 - 日志注入漏洞

Question

我一直在尝试在我们的 spring 应用程序中处理 log4j2 的安全性以传入 Veracode。特别是 CWE 117 - 日志注入漏洞。我们有一个带有 spring-boot-starter-log4j2 的 spring 应用程序。
我已尝试配置 log4j2 模式：

<PatternLayout pattern="%d{DEFAULT} [%t] %-5level %logger{36} - %encode{%m}%n" />

但它不起作用。我也尝试过这样的事情：

<PatternLayout pattern="%d{ISO8601} %-5p - %encode{ %.-500m }{CRLF}%n" />

或

<PatternLayout pattern="%d{HH:mm:ss.SSS} %marker [%t] %-5level %logger{36} - %encode{%msg}{CRLF}%n"/>

我仍然得到 veracode 结果：

117   Improper Output Neutralization for Logs   WelcomeResource.java: 15
117   Improper Output Neutralization for Logs   WelcomeResource.java: 16

我们不想使用 ESAPI 或任何日志外观，我们不想更改我们代码中的所有日志行，有数千次出现。我们想在下面或这里的代码片段中使用 straigt 设置： https://owasp.org/www-project-cheat-sheets/cheatsheets/Injection_Prevention_Cheat_Sheet_in_Java.html#Log_Injection 要么 https://github.com/javabeanz/owasp-security-logging/wiki/Log-Forging

但是没用。问题出在哪里？

这是我们的代码片段：

build.gradle:

plugins {
    id 'org.springframework.boot' version '2.2.0.RELEASE'
    id 'io.spring.dependency-management' version '1.0.8.RELEASE'
    id 'java'
    id 'maven'
}

group = 'com.example'
version = '0.0.2-SNAPSHOT'

repositories {
    mavenCentral()
}

configurations {
    all {
        exclude group: 'org.springframework.boot', module: 'spring-boot-starter-logging'
    }
}

dependencies {
    implementation 'org.springframework.boot:spring-boot-starter-actuator'
    implementation 'org.springframework.boot:spring-boot-starter-web'
    implementation 'org.springframework.boot:spring-boot-starter-log4j2'
}

App.java:

package com.example.demoLog4j2;

import org.slf4j.LoggerFactory;
import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;

@SpringBootApplication

    public class App {

        final static org.slf4j.Logger Logger = LoggerFactory.getLogger("App");

        public static void main(String[] args) {
            SpringApplication.run(App.class, args);
            System.out.println(" //---------------------->> DemoLog4j2 Application started... ");
            Logger.info(" Logger implementation: " + Logger.getClass().getName());
        }
    }

WelcomeResource.java:

package com.example.demoLog4j2;

import org.slf4j.LoggerFactory;
import org.springframework.web.bind.annotation.*;

@RestController
public class WelcomeResource {

    private static final String welcomeMessage = "Welcome...";

    final org.slf4j.Logger Logger = LoggerFactory.getLogger(this.getClass());

    @GetMapping("/name")
    public String getName(@RequestParam(name="name", required = false, defaultValue = "Josef") String name) {
        Logger.info( "----- name: " + name);
        Logger.debug( "--- name: " + name );
        return "name: " + name;
    }
}

log4j2.xml:

<?xml version="1.0" encoding="UTF-8"?>
<Configuration status="INFO ">
    <Appenders>
        <Console name="Console" target="SYSTEM_OUT">
            <!-- <PatternLayout pattern="%d{DEFAULT} [%t] %-5level %logger{36} - %encode{%m}%n" /> -->
            <!-- <PatternLayout pattern="%d{HH:mm:ss.SSS} %marker [%t] %-5level %logger{36} - %encode{%msg}{CRLF}%n" /> -->
            <PatternLayout pattern="%d{ISO8601} %-5p - %encode{ %.-500m }{CRLF}%n" />
        </Console>
    </Appenders>
    <Loggers>
        <Root level="INFO">
            <AppenderRef ref="Console" />
        </Root>
    </Loggers>
</Configuration>

Answer 1

我们终于在 log4j2 配置文件中使用“%encode{%msg}”解决了日志注入威胁。它解决了威胁，但没有解决 veracode 报告。我们忽略了它，因为它是虚假报告。不知道veracode有没有修好

log4j2, CWE 117 - 日志注入漏洞

log4j2, CWE 117 - log injection vulnerability

log4j2

veracode