Summary
Improper Neutralization of Equivalent Special Elements in loguru can lead to Log Injection on all logging methods.
It is possible to inject newlines (“n”) which will create a new log entry in the logfile.
This can lead to attackers tampering with logs and a loss of integrity of the log files as a result.
Product
loguru before 0.6.0.
Impact
Users can inject logs into loguru via newlines.
This affects logger.trace, logger.debug, logger.info, logger.success, logger.warning, logger.error, logger.critical, logger.exception, logger.log functions (9 functions in total).
Steps to reproduce
username = "Josh just logged inn2022-01-24 22:39:30.976 | INFO | __main__:<module>:5 - User James"
logger.add("inject.log")
logger.info("User " + username + " just logged in.")Expected result:
2022-01-24 22:39:30.976 | INFO | __main__:<module>:5 - User James just logged in.Remediation
Escape special characters (such as n and r) by default.
Update loguru to version 0.6.0.
Credit
This issue was reported by @haxatron through huntr.dev.
