# LogInjector: Detecting Web Application Log Injection Vulnerabilities
## 1 Introduction  
The logging functionality is the basic functionality of most web applications. It records the running information, user operations, debugging, warning, and error information of the web application, which provides great convenience for the website administrator to operate and maintain the website. However, suppose the web application does not properly handle the log storage and viewing process. In that case, malicious data input by the user can be written into the log. When the web interface for viewing logs is accessed, the injected malicious data will be executed as code. This will result in a log injection vulnerability of the web application, referred to as a log injection vulnerability after this. We define the web interface that can write logs as a log-injectable interfaces and the web interface for viewing logs as a view-logs interface. Nowadays, almost every web application has a logging functionality, and the security awareness of web application developers is uneven. Some developers do not properly and effectively process the data entered by users into the log. As a result, a large number of web applications may have log injection vulnerabilities and bring potential risks to web applications. Log injection vulnerabilities are more serious than other regular vulnerabilities of web applications. On the one hand, because the log injection vulnerabilities will persistently store the malicious payload in the database or file on the web application server side, it will cause persistent harm to the web application. On the other hand, unauthenticated users can inject malicious data into the logs. For example, some web applications will record the login information of users who fail to authenticate. Unauthenticated users can inject data into the log, so the log injection vulnerability exploit conditions are low. For this type of vulnerability detection, the main challenges are as follows:  
* There are many web interfaces in web applications that interact with users. However, only a few can inject data into the log, so it is challenging to accurately find the log-injectable interfaces. * The log injection vulnerabilities need to be triggered by accessing the view-logs interface of the web application, and it is difficult to identify the view-logs interface. * Each web application has a different input-filtering check. It is challenging to pass the application-specific input-filtering checks of the web application and to ensure that the injected data can be executed. To address these challenges, we propose LogInjector, an efficient detection framework for log injection vulnerabilities. Specifically, first, LogInjector obtains the log storage form and location, and then LogInjector uses the extended dynamic crawler to find the log-injectable interfaces. Second, LogInjector combines dynamic crawler and static features to identify the view-logs interfaces. Finally, based on the obtained information, LogInjector adopts a dynamic testing method based on the feedback-guided mutation to detect log injection vulnerabilities. The contributions of this paper are summarized as follows:  
* We systematically studied the web application log injection vulnerabilities for the first time and proposed LogInjector, an effective web application log injection vulnerability-detection method;
* LogInjector can automatically obtain the log storage location, the log-injectable interfaces, and the view-logs interfaces. Based on this information, LogInjector employs dynamic testing based on the feedback-guided mutation to detect log injection vulnerabilities effectively;
* We implemented a prototype of LogInjector and evaluated the effectiveness of LogInjector on 14 web applications. LogInjector detected a total of 16 log injection vulnerabilities, including 6 zero-day vulnerabilities. The rest of the paper is structured as follows. In Section 2, we give the background knowledge on the log injection vulnerabilities. Section 3 discusses related work. Section 4 discusses an overview of LogInjector.