Description

Detects log forging vulnerabilities in FastAPI applications where user-controlled input is logged without proper sanitization. Attackers can inject malicious content into log files, potentially leading to log poisoning, false audit trails, or exploitation of log processing systems.

Detection Strategy

• FastAPI framework must be imported in the code

• Logger instances or logging factory functions must be present in the code

• A logging statement must contain user input data that originates from FastAPI request parameters, headers, or body

• The user input data must flow into the logging call without proper sanitization or validation

Vulnerable code example

from fastapi import FastAPI, Query, Form, Header, Cookie
from loguru import logger
import structlog

app = FastAPI()
struct_logger = structlog.get_logger()

@app.post("/user")...

✅ Secure code example

from fastapi import FastAPI, Query, Form, Header, Cookie
from loguru import logger
import structlog
import re

app = FastAPI()
struct_logger = structlog.get_logger()
...