Exploiting unsanitized or unvalidated inputs to application logs.

Exploiting unsanitized or unvalidated inputs to application logs.

• A. HTML injection
• B. LDAP Directory Services
• C. log injection attacks
• D. Server-side JavaScript injections

Answer: (C)

This item centers on log injection, where unsanitized or unvalidated inputs are written into application logs. When log entries simply reflect user-supplied data, an attacker can embed special characters like newlines or log-format delimiters. This can forge additional log lines, split a single entry into multiple entries, or alter the appearance of logs, making it look like legitimate events occurred when they did not. The result is tampered audit trails, which can mislead investigators, hide malicious activity, or disrupt log parsing and alerting that rely on a predictable log format. This is different from HTML injection (targeting web page rendering), LDAP injection (tampering with directory service queries), or server-side JavaScript injections (code execution on the server).

This item centers on log injection, where unsanitized or unvalidated inputs are written into application logs. When log entries simply reflect user-supplied data, an attacker can embed special characters like newlines or log-format delimiters. This can forge additional log lines, split a single entry into multiple entries, or alter the appearance of logs, making it look like legitimate events occurred when they did not. The result is tampered audit trails, which can mislead investigators, hide malicious activity, or disrupt log parsing and alerting that rely on a predictable log format. This is different from HTML injection (targeting web page rendering), LDAP injection (tampering with directory service queries), or server-side JavaScript injections (code execution on the server).