Veracode issue Crashlytics CWE ID 117 Logger.java

[dsuresh-ap]

environment

• Android Studio version: Arctic Fox 2020.3.1 Patch 2
• Firebase Component: Crashlytics
• Component version: BOM 28.4.0

Steps to reproduce:

Veracode Issue CWE ID 117
Improper Output Neutralization for Logs
https://cwe.mitre.org/data/definitions/117.html

The issue has to do with Firebase's Logger.java class and calls to .d() and .w() related to javax.net.ssl.HttpsURLConnection.getInputStream.

Relevant Code:

We identified k4 as com.google.firebase.crashlytics.internal.Logger -> k4.f: in our mapping.txt file.

Attack Vector: android.util.Log.d and android.util.Log.w
k4/Logger.java

Number of Modules Affected: 1

Description: This call to android.util.Log.d() could result in a log forging attack. Writing untrusted data into a log file allows an attacker to forge log entries or inject malicious content into log files. Corrupted log files can be used to cover an attacker's tracks or as a delivery mechanism for an attack on a log viewing or processing utility. For example, if a web administrator uses a browser-based utility to review logs, a cross-site scripting attack might be possible. The second argument to d() contains tainted data from the variable p0. The tainted data originated from an earlier call to javax.net.ssl.HttpsURLConnection.getInputStream.

Remediation: Avoid directly embedding user input in log files when possible. Sanitize untrusted data used to construct log entries by using a safe logging mechanism such as the OWASP ESAPI Logger, which will automatically remove unexpected carriage returns and line feeds and can be configured to use HTML entity encoding for non-alphanumeric data. Alternatively, some of the XSS escaping functions from the OWASP Java Encoder project will also sanitize CRLF sequences. Only create a custom blocklist when absolutely necessary. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.

[aguatno]

Hi @dsuresh-ap thanks for reporting. Security is our main concern and we definitely welcome this kind of report. We will discuss this and let's see what we can do. Any extra information that you could share would be very helpful.

[dsuresh-ap]

It would be great if there was a way to disable the Crashlytics internal logging. Because of the way logLevel is set on init and how canLog() will check that value first, there is not way to turn off all logging.

// com.google.firebase.crashlytics.internal.Logger.java
public Logger(String tag) {
  this.tag = tag;
  this.logLevel = Log.INFO;
}

private boolean canLog(int level) {
  return logLevel <= level || Log.isLoggable(tag, level);
}

[aguatno]

This is noted @dsuresh-ap. I'll tag this issue as a feature for now and we'll try what what we can do. Thanks.