Description

Detects when unsanitized user-controlled input is written into Log4js log messages in TypeScript applications. Without proper sanitization, attackers can inject newline characters or forged log entries into the log stream, misleading security monitoring systems and hiding malicious activity.

Detection Strategy

• Identifies calls to Log4js logger methods (info, error, warn, debug, fatal, trace, log)

• Resolves the logger instance back to its definition to confirm it was obtained via log4js.getLogger()

• Inspects the arguments passed to the log call for symbols, element accesses, or member accesses that originate from HTTP request data

• Reports a vulnerability when user-controlled input reaches a Log4js log method without sanitization or validation

Vulnerable code example

import express, { Request, Response } from 'express';
import log4js from 'log4js';

const app = express();

log4js.configure({
  appenders: { out: { type: 'console' } },
  categories: { default: { appenders: ['out'], level: 'info' } }...

✅ Secure code example

import express, { Request, Response } from 'express';
import log4js from 'log4js';

const app = express();

log4js.configure({
  appenders: { out: { type: 'console' } },
  categories: { default: { appenders: ['out'], level: 'info' } }...