VNX-532: Insertion of Sensitive Information into Log File: whole request logged

Field	Value
Rule ID	VNX-532
Severity	Medium
SARIF level	warning
Kind	sast
Languages	Go, Java, JavaScript / TypeScript, Python
CWE	CWE-532
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	CWSS:1.0/TI:M/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:M/DI:H/EX:M/EC:N/P:C
Tags	log-sensitive logging cwe-532
Source	internal/sast/rules/vnx-532.rego

Overview

VNX-532 maps to CWE-532: Insertion of Sensitive Information into Log File. Logging a whole request part writes the passwords, session cookies, bearer tokens and API keys of every user into the log. The rule reports a logging or print call whose arguments (read across up to two continuation lines) contain:

• Python: request.headers, request.POST, request.form, request.data, request.body, request.json, request.get_json(), request.cookies/COOKIES, request.META, or request.headers["Authorization"];
• JavaScript/TypeScript: req.headers, req.body, req.cookies (also inside JSON.stringify or an object), or req.headers.authorization/cookie;
• Go: r.Header, r.Form, r.PostForm, r.MultipartForm, r.Cookies(), r.Header.Get("Authorization"), or the output of httputil.DumpRequest with no Authorization redaction in between;
• Java: request.getHeader("Authorization")/("Cookie"), getParameterMap(), getCookies(), or a Spring @RequestHeader HttpHeaders/Map parameter.

What Gets Flagged

logger.info("login attempt: %s", request.POST)          # FLAGGED

logger.info(`headers: ${JSON.stringify(req.headers)}`);  // FLAGGED

dump, _ := httputil.DumpRequest(r, true)
log.Println(string(dump))                                // FLAGGED

What Is Not Flagged

One ordinary header or field (User-Agent, X-Request-Id, request.path), sizes and key lists (len(request.body), request.POST.keys()), presence tests (r.Header.Get("Authorization") != "", "Authorization" in request.headers), a request part passed to a template or response rather than a log, comments and test code. Logging a variable named as a credential (password, token, secret) is covered by VNX-SEC-022, VNX-GO-040, VNX-JAVA-021 and VNX-NODE-031.

Remediation

1. Log only the fields you need (method, path, status, request id).
2. When headers must be logged, drop or mask Authorization, Cookie, Set-Cookie and API-key headers first.
3. Never log request bodies of authentication, payment or account endpoints.

References

• CWE-532: Insertion of Sensitive Information into Log File
• OWASP Logging Cheat Sheet

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-532
// nosec vnx-532

Or record an ignore rule: vulnetix ignore add --rule vnx-532 --reason "...". See Suppressing findings.