Veracode reports Microsoft.EntityFrameworkCore.SQLServer 8.0.4 with CRLF flaw

Question

Veracode is reporting an Improper Output Neutralization for Logs (CWE ID 117) in Microsoft.EntityFrameworkCore.SQLServer.dll as medium risk in:

void b__0(Microsoft.Extensions.Logging.ILogger)

Is the dll unsecure? or how can i fix this.

Answer 1

Hi,@DIEGO CAMILO SILVA TELLEZ. Welcome to Microsoft Q&A. 

This error is not because Microsoft.EntityFrameworkCore.SQLServer.dll is unsafe. In .Net, this security flaw usually occurs when writing logs.

 

As the description says, if a user maliciously or accidentally inserts end-of-line characters (CR [carriage return], LF [line feed], or CRLF [a combination of the two]) into the data written to the log, it may cause problems when parsing the log, or be used by attackers to forge log entries.

 

You could prevent it as follows:

1. Before writing any untrusted data to the log file, you should always properly validate and sanitize the data.
2. Prevent characters that cause CRLF injection from being written to the log. Replace all \r and \n (respectively) with other characters.
3. Encode the data before writing to the log.

 

For a more detailed explanation, you could refer to the official documentation: CWE 117: Improper Output Sanitization for Logs | ASP.NET | Veracode

 

Some security reminders when writing logs(Determine whether it is necessary based on your actual situation):

1. Make sure all log messages are properly neutralized before output to avoid directly outputting user-entered data
2. Filter out all sensitive information such as passwords, credit card numbers, etc. before logging. You could use regular expressions or other string processing methods to achieve this.
3. Limit access to log files. This could be achieved through the file permission settings of the operating system or the access control mechanism of the application.
4. Audit log files regularly to check for abnormal or suspicious log records.

---

If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

I understand and see that it is a conceptual and configuration issue of Veracode, since in my code the logger is not implemented, however, it seems that Veracode reports false positives in delegated DLLs that have the interface even though it is not implemented. It will be validated with the security team to see if it is possible to adjust the detection of Veracode.

Answer 3

EF core is only using the logging interface. you will need to check the loggers that you are actually using if they have any issues with \n.