What can an attacker do with a log injection attack?

What can an attacker do with a log injection attack?

• A. Injection of commands a parser can execute
• B. Overwrite log files
• C. Disable authentication
• D. Encrypt logs

Answer: (A)

Log injection is about putting crafted data into logs in a way that a downstream component might treat as commands or executable instructions. When a system later reads or processes those logs with a parser, interpreter, or script that uses the log content unsafely, the injected payload can be executed. That’s why the attackers’ most impactful outcome in this scenario is injecting commands that a parser can execute, potentially leading to code execution, privilege escalation, or other breaches. For example, if a log entry includes a crafted string and a script later reads that log line to build a command without proper sanitization, the embedded payload could run. Overwriting log files, disabling authentication, or encrypting logs aren’t inherent results of a log injection in the same way, and they don’t hinge on making a parser execute attacker-supplied commands.

Log injection is about putting crafted data into logs in a way that a downstream component might treat as commands or executable instructions. When a system later reads or processes those logs with a parser, interpreter, or script that uses the log content unsafely, the injected payload can be executed. That’s why the attackers’ most impactful outcome in this scenario is injecting commands that a parser can execute, potentially leading to code execution, privilege escalation, or other breaches.

For example, if a log entry includes a crafted string and a script later reads that log line to build a command without proper sanitization, the embedded payload could run. Overwriting log files, disabling authentication, or encrypting logs aren’t inherent results of a log injection in the same way, and they don’t hinge on making a parser execute attacker-supplied commands.