Log_Forging @ /webgoat-lessons/xxe/src/main/java/org/owasp/webgoat/xxe/Ping.java

[AASMACMX]

Log_Forging issue exists @ Ping.java in branch main

Method logRequest at line 49 of /webgoat-lessons/xxe/src/main/java/org/owasp/webgoat/xxe/Ping.java gets user input from element text. This element’s value flows through the code without being properly sanitized or validated, and is eventually used in writing an audit log in logRequest at line 51 of /webgoat-lessons/xxe/src/main/java/org/owasp/webgoat/xxe/Ping.java.

This may enable Log Forging.

Namespace: CxDemoInABoxRepos
Repository: Java-Webgoat
Repository Url: https://github.com/CxDemoInABoxRepos/Java-Webgoat
CxAST-Project: CxDemoInABoxRepos/Java-Webgoat
CxAST platform scan: 466e73ae-3cc9-415a-8383-b7e20e1af3be
Branch: main
Application: Java-Webgoat
Severity: LOW
State: TO_VERIFY
Status: RECURRENT
CWE: 117
Lines: 49

---

References
Read more