Skip to content

Seam log injection via dynamic expression evaluation

Description

Detected usage of string concatenation in Seam logging methods, which support expression evaluation via EL (Expression Language). This can lead to arbitrary expression execution if user input is not sanitized.

Examples

Insecure Code

java
log.info("Action performed by user: " + username);

Secure Code

java
log.info("Action performed by user: #0", username);

Remediation

Use positional arguments instead of string concatenation for logging

Rule Details

FieldValue
IDCODE-0759
CategoryInjection
SeverityCRITICAL
CWECWE-95
ConfidenceHIGH
ImpactHIGH
LikelihoodMEDIUM
ExploitabilityMODERATE
Tagslogging, injection
OWASPA03:2021-Injection