CWE-532 Base Incompleto Medium likelihood

Insertion of Sensitive Information into Log File

This vulnerability occurs when an application unintentionally writes confidential data, such as passwords or API keys, into its log files.

Definición

What is CWE-532?

This vulnerability occurs when an application unintentionally writes confidential data, such as passwords or API keys, into its log files.
Developers often add logging statements for debugging, but these can accidentally capture sensitive user data or system secrets. When these logs are stored insecurely or with broad permissions, attackers can read them to steal credentials, impersonate users, or gain unauthorized access to internal systems. This is a common oversight that turns a routine troubleshooting tool into a significant security liability. Preventing this requires careful code reviews to sanitize log output and configuring loggers to exclude sensitive fields. While SAST tools can catch the pattern, Plexicus uses AI to suggest the actual code fix—like replacing a sensitive value with a hash or redacting it entirely—saving hours of manual work. Managing this at scale across numerous applications is difficult; an ASPM like Plexicus can help you track and remediate these flaws across your entire software stack.
Vulnerability Diagram CWE-532
Insertion of Sensitive Information into Log Login handler log.info("body: " + body) app.log 11:00 INFO POST /login body: {user:"a", pw:"hunter2"} cookie: session=abc123 card: 4111-1111-1111-1111 11:01 INFO ... Anyone w/ logs SIEM, support, CI Secrets and PII written to logs end up in many systems and people.
Impacto en el mundo real

Real-world CVEs caused by CWE-532

  • CVE-2017-9615

    verbose logging stores admin credentials in a world-readable log file

  • CVE-2018-1999036

    SSH password for private key stored in build log

Cómo lo explotan los atacantes

Ruta del atacante paso a paso

  1. 1

    In the following code snippet, a user's full name and credit card number are written to a log file.

  2. 2

    This code stores location information about the current user:

  3. 3

    When the application encounters an exception it will write the user object to the log. Because the user object contains location information, the user's location is also written to the log.

  4. 4

    In the example below, the method getUserBankAccount retrieves a bank account object from a database using the supplied username and account number to query the database. If an SQLException is raised when querying the database, an error message is created and output to a log file.

  5. 5

    The error message that is created includes information about the database query that may contain sensitive information about the database or query logic. In this case, the error message will expose the table name and column names used in the database. This data could be used to simplify other attacks, such as SQL injection (CWE-89) to directly access the database.

Ejemplo de código vulnerable

Vulnerable Java

In the following code snippet, a user's full name and credit card number are written to a log file.

Vulnerable Java 
logger.info("Username: " + usernme + ", CCN: " + ccn);
Ejemplo de código seguro

Secure pseudo

Seguro pseudo 
// Validate, sanitize, or use a safe API before reaching the sink.
function handleRequest(input) {
  const safe = validateAndEscape(input);
  return executeWithGuards(safe);
}
What changed: the unsafe sink is replaced (or the input is validated/escaped) so the same payload no longer triggers the weakness.
Lista de prevención

How to prevent CWE-532

  • Architecture and Design / Implementation Consider seriously the sensitivity of the information written into log files. Do not write secrets into the log files.
  • Distribution Remove debug log files before deploying the application into production.
  • Operation Protect log files against unauthorized read/write.
  • Implementation Adjust configurations appropriately when software is transitioned from a debug state to production.
Señales de detección

How to detect CWE-532

Automated Static Analysis High

Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

Auto-corrección de Plexicus

Plexicus detecta automáticamente CWE-532 y abre un PR de corrección en menos de 60 segundos.

Codex Remedium escanea cada commit, identifica esta debilidad concreta y entrega un pull request listo para revisión con el parche. Sin tickets. Sin traspasos.

Solicitar demo Probar Plexicus gratis
Preguntas frecuentes

Frequently asked questions

¿Qué es CWE-532?

This vulnerability occurs when an application unintentionally writes confidential data, such as passwords or API keys, into its log files.

¿Qué gravedad tiene CWE-532?

MITRE califica la probabilidad de explotación como Media — la explotación es realista pero suele requerir condiciones específicas.

¿Qué lenguajes o plataformas se ven afectados por CWE-532?

MITRE no ha especificado plataformas afectadas para esta CWE — puede aplicar a la mayoría de los stacks de aplicaciones.

¿Cómo puedo prevenir CWE-532?

Consider seriously the sensitivity of the information written into log files. Do not write secrets into the log files. Remove debug log files before deploying the application into production.

¿Cómo detecta y corrige Plexicus CWE-532?

El motor SAST de Plexicus detecta la firma de flujo de datos para CWE-532 en cada commit. Cuando hay coincidencia, nuestro agente Codex Remedium abre un PR de corrección con el código corregido, las pruebas y un resumen de una línea para el revisor.

¿Dónde puedo aprender más sobre CWE-532?

MITRE publica la definición canónica en https://cwe.mitre.org/data/definitions/532.html. También puedes consultar la documentación de OWASP y NIST para guías relacionadas.

Debilidades relacionadas

Weaknesses related to CWE-532

CWE-538 Padre

Insertion of Sensitive Information into Externally-Accessible File or Directory

This vulnerability occurs when an application unintentionally stores confidential data—like passwords, API keys, or personal user…

CWE-540 Hermano

Inclusion of Sensitive Information in Source Code

This vulnerability occurs when sensitive information like passwords, API keys, or internal logic is exposed within source code that…

CWE-651 Hermano

Exposure of WSDL File Containing Sensitive Information

This vulnerability occurs when a Web Service Definition Language (WSDL) file, which acts as a public blueprint for a web service, is…

Recursos

Further reading

Listo cuando tú lo estés

Deja de pagar por desarrollador.
Empieza a cerrar el bucle.

Plexicus es el ASPM nativo de IA que escanea, filtra, corrige, pentestea y explica — de forma autónoma. Desarrolladores ilimitados, repos ilimitados, acciones de IA de uso justo. Nivel gratuito real, €269/mo anual cuando estés listo.

Comenzar gratis Reservar una demo