Audit required: Configuring loggers can be security-sensitive PY-A6006
Configuring loggers is security sensitive
46 return handler
47
48
49class NssLogger(logging.Logger):50 def __init__(self, name: str = 'nukeserversocket') -> None:
51 super().__init__(name)
52 self.setLevel(logging.DEBUG)Configuring loggers is security sensitive
14PACKAGE_LOG.parent.mkdir(parents=True, exist_ok=True)
15
16
17class ConsoleHandler(logging.Handler):18 def __init__(self, console: NssConsole) -> None:
19 super().__init__()
20 self.set_name('console')
Description
This issue higlights code that initiates loggers configuration. This should be audited to make sure no sensitive information is being logged.
Since this is an audit issue, some occurrences may be harmless here. The goal is to bring the issue in attention. Please take a look at the Audit Checklist mentioned later in the description.
If the occurrences doesn't seem to be valid, please feel free to ignore them.
The configuration determines the type of information logged and how it is logged. Logs might contain sensitive information which can be used by malicious users. But they should contain sufficient information to understand the damage an attacker might have inflicted.
Audit Checklist: Make sure these points are taken care of:
- Logs doesn't contain sensitive information. This can happen when the logger is in the
debugmode. - Logs aren't growing without limit. This happens when additional information is written into logs every time a user performs an action and the user can perform the action any number of times.
- Logs contain enough information to understand the damage, in case there's a security incident.
- Log format is easy to parse and process automatically. Processing logs rapidly is important in case of an attack.
- Logs are stored in a secure location which is only accessible to system administrators.
Bad practice
import logging
import os
from logging.config import fileConfig, dictConfig
logging.basicConfig(level=os.environ.get("LOGLEVEL", "INFO"))
fileConfig(fname='file.conf', disable_existing_loggers=False) # Disabling the loggers.
dictConfig(config) # Configuring a logger shoud be audited.
logging.disable() # Disabling the logger.
class SomeLogger(logging.Logger): # A custom logger implementation shoud be audited
...
def set_logger_class(logger_class):
logging.setLoggerClass(logger_class) # A custom logger implementation shoud be audited
def set_logging_last_resort(last_resort):
logging.lastResort = last_resort # Hints the absence of any logging configuration. It is recommended to set up logging properly.
References:
- OWASP Top 10 2021 Category A09 - Security Logging and Monitoring Failures
- CWE 532 - Insertion of Sensitive Information into Log File
- CWE 778 - Insufficient logging