CWE-532: Insertion of Sensitive Information into Log File - Remediation Guide

Introduction

CWE-532: Insertion of Sensitive Information into Log File refers to the security risk of inadvertently logging sensitive data, such as Personally Identifiable Information (PII), in an application’s log files. This can occur due to insufficient data handling policies or oversight within the logging mechanisms. Exposing PII in logs can lead to significant security and privacy breaches. This article discusses the risks associated with PII exposure through CWE-532 and presents remediation strategies, complete with coding examples in Java, JavaScript, and Python.

Understanding the Risks

Direct Risks

1. Data Theft: Logs containing sensitive information can be a target for attackers, leading to data theft.

2. Unauthorized Disclosure: Unintentional exposure of sensitive information to unauthorized personnel through logs.

3. Compliance Violations: Storing PII in logs can violate data protection regulations such as GDPR, resulting in legal and financial penalties.

Indirect Risks

1. Reputational Damage: Public incidents of PII exposure can harm an organization’s reputation, resulting in loss of customer trust and business.

2. Operational Disruptions: Addressing a data breach can divert resources from regular operations and lead to significant remediation costs.

3. Increased Liability: Potential for lawsuits and regulatory fines due to negligence in handling sensitive data.

Remediation Techniques

Effective management of log output is crucial for preventing unintended PII exposure. Techniques include omitting sensitive data, masking data, and encrypting data before it is logged.

1. Omitting Data

Ensure that logging mechanisms are designed to exclude sensitive data.

Java

import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

public class LogHelper {
    private static final Logger logger = LoggerFactory.getLogger(LogHelper.class);

    public void logDebugInfo(String username) {
        logger.debug("User login attempt: " + username);
        // Ensure no sensitive PII such as passwords or social security numbers are logged
    }
}

Javascript

const logger = require('winston');

function logLoginAttempt(username) {
    logger.info(`User login attempt: ${username}`);
    // Ensure sensitive PII like address or financial information is not logged
}

Python

import logging

logger = logging.getLogger('user_activity')

def log_login_attempt(username):
    logger.info(f'User login attempt: {username}')
    # Make sure sensitive PII is omitted from logs

2. Masking Data

If non-sensitive identifiers must be logged, ensure they are masked or anonymized.

Java

public class DataMasker {
    public String maskEmail(String email) {
        int atIndex = email.indexOf('@');
        return email.substring(0, 1) + "****" + email.substring(atIndex - 1);
    }
}

Javascript

function maskEmail(email) {
    const atIndex = email.indexOf('@');
    return email[0] + '****' + email[atIndex - 1] + email.substring(atIndex);
}

Python

def mask_email(email):
    atIndex = email.index('@')
    return email[0] + '****' + email[atIndex - 1] + email[atIndex:]

3. Encrypting Data

Encrypt sensitive data if it must be included in logs, to protect it against unauthorized access.

Java

import javax.crypto.Cipher;
import javax.crypto.SecretKey;
import javax.crypto.spec.GCMParameterSpec;
import java.nio.ByteBuffer;
import java.nio.charset.StandardCharsets;
import java.security.SecureRandom;

public class SecurityUtils {
    // secretKey is supplied by the caller, sourced from your KMS or secret store
    public static String encryptData(String data, SecretKey secretKey) throws Exception {
        byte[] iv = new byte[12];
        new SecureRandom().nextBytes(iv);

        Cipher cipher = Cipher.getInstance("AES/GCM/NoPadding");
        cipher.init(Cipher.ENCRYPT_MODE, secretKey, new GCMParameterSpec(128, iv));
        byte[] encrypted = cipher.doFinal(data.getBytes(StandardCharsets.UTF_8));

        byte[] payload = ByteBuffer.allocate(iv.length + encrypted.length).put(iv).put(encrypted).array();
        return java.util.Base64.getEncoder().encodeToString(payload);
    }
}

Javascript

const crypto = require('crypto');

// key: 32-byte Buffer loaded from your KMS or secret store
function encryptData(data, key) {
    const iv = crypto.randomBytes(16);
    const cipher = crypto.createCipheriv('aes-256-cbc', key, iv);
    const encrypted = Buffer.concat([cipher.update(data, 'utf8'), cipher.final()]);
    return iv.toString('hex') + ':' + encrypted.toString('hex');
}

Python

from cryptography.fernet import Fernet

# key: Fernet key loaded from your secret store, never generated per call
def encrypt_data(data, key):
    cipher_suite = Fernet(key)
    encrypted_data = cipher_suite.encrypt(data.encode())
    return encrypted_data.decode()

Conclusion

Mitigating the risks associated with CWE-532 is essential for protecting PII from unauthorized access and maintaining compliance with data protection regulations. By implementing strategies such as omitting, masking, and encrypting sensitive data, organizations can enhance the security of their logging practices and safeguard the privacy of individuals.