Log_Forging @ LabelService.java

[nitinp1]

Log_Forging issue exists @ LabelService.java in branch main

Method fetchLabels at line 81 of /webgoat-container/src/main/java/org/owasp/webgoat/service/LabelService.java gets user input from element lang. This element’s value flows through the code without being properly sanitized or validated, and is eventually used in writing an audit log in fetchLabels at line 85 of /webgoat-container/src/main/java/org/owasp/webgoat/service/LabelService.java.

This may enable Log Forging.

Namespace: nitinp1
Repository: WebGoat
Repository Url: https://github.com/nitinp1/WebGoat
CxAST-Project: nitinp1/WebGoat
CxAST platform scan: 371cf28e-43c8-4e90-86fa-65d2f0911dc1
Branch: main
Application: WebGoat
Severity: LOW
State: TO_VERIFY
Status: RECURRENT
CWE: 117
Lines: 81

---

References
Read more