TypeScript : Log forging

The application writes data from an untrusted source to the event log. An attacker can spoof log entries or to inject malicious content there.

As a rule, the applications records in the transaction history for further processing, debugging, or statistics gathering into the log. Log analysis can be done manually or automatically.

If the data entered by an attacker are logged “as is”, structure or semantics of the file may be violated. An attacker will be able to inject false entries in the log or disrupt the structure of the file, causing log handler malfunctions. In the worst case, malicious code that exploits a known vulnerability in the handler may be injected into the log.