Log Forging

...
DATA log_msg TYPE bal_s_msg.

val = request->get_form_field( 'val' ).

log_msg-msgid = 'XY'.
log_msg-msgty = 'E'.
log_msg-msgno = '123'.
log_msg-msgv1 = 'VAL: '.
log_msg-msgv2 = val.

CALL FUNCTION 'BAL_LOG_MSG_ADD'
  EXPORTING
    I_S_MSG          = log_msg
  EXCEPTIONS
    LOG_NOT_FOUND    = 1
    MSG_INCONSISTENT = 2
    LOG_IS_FULL      = 3
    OTHERS           = 4.
...

XY E 123 VAL: FOO

XY E 123 VAL: FOO XY E 124 VAL: BAR

var params:Object = LoaderInfo(this.root.loaderInfo).parameters;
var val:String = String(params["username"]);
var value:Number = parseInt(val);
if (value == Number.NaN) {
  trace("Failed to parse val = " + val);
}

Failed to parse val=twenty-one

Failed to parse val=twenty-one

User logged out=badguy

...
string val = (string)Session["val"];
try {
int value = Int32.Parse(val);
}
catch (FormatException fe) {
log.Info("Failed to parse val= " + val);
}
...

INFO: Failed to parse val=twenty-one

INFO: Failed to parse val=twenty-one

INFO: User logged out=badguy

long value = strtol(val, &endPtr, 10);
if (*endPtr != '\0')
	syslog(LOG_INFO,"Illegal value = %s",val);
...

Illegal value=twenty-one

	INFO: Illegal value=twenty-one

	INFO: User logged out=evil

...
01  LOGAREA.
     05  VALHEADER        PIC X(50) VALUE 'VAL: '.
     05  VAL              PIC X(50).
...

EXEC CICS
  WEB READ
  FORMFIELD(NAME)
  VALUE(VAL)
  ...
END-EXEC.

EXEC DLI
  LOG
  FROM(LOGAREA)
  LENGTH(50)
END-EXEC.
...

VAL: FOO

VAL: FOO VAL: BAR

<cflog file="app_log" application="No" Thread="No" 
       text="Failed to parse val="#Form.val#">

"Information",,"02/28/01","14:50:37",,"Failed to parse val=twenty-one"

"Information",,"02/28/01","14:50:37",,"Failed to parse val=twenty-one"

"Information",,"02/28/01","14:53:40",,"User logged out: badguy"

    func someHandler(w http.ResponseWriter, r *http.Request){
        r.parseForm()
        name := r.FormValue("name")
        logout := r.FormValue("logout")
        ...
        if (logout){
            ...
        } else {
            log.Printf("Attempt to log out: name: %s logout: %s", name, logout)
        }
    }

Attempt to log out: name: admin logout: twenty-one

Attempt to log out: name: admin logout: 1                       logout: twenty-one

var cp = require('child_process');
var http = require('http');
var url = require('url');

function listener(request, response){
  var val = url.parse(request.url, true)['query']['val'];
  if (isNaN(val)){
    console.log("INFO: Failed to parse val = " + val);
  }
  ...
}
...
http.createServer(listener).listen(8080);
...

INFO: Failed to parse val = twenty-one

INFO: Failed to parse val=twenty-one

INFO: User logged out=badguy

long value = strtol(val, &endPtr, 10);
if (*endPtr != '\0')
	NSLog("Illegal value = %s",val);
...

    INFO: Illegal value=twenty-one

	INFO: Illegal value=twenty-one

	INFO: User logged out=evil

<?php
    $name   =$_GET['name'];
    ...
    $logout =$_GET['logout'];

    if(is_numeric($logout))
    {
        ...
    }
    else
    {
        trigger_error("Attempt to log out: name: $name logout: $val");
    }
?>

PHP Notice: Attempt to log out: name: admin logout: twenty-one

PHP Notice: Attempt to log out: name: admin logout: 1                       logout: twenty-one

    name = req.field('name')
    ...
    logout = req.field('logout')

    if (logout):
        ...
    else:
        logger.error("Attempt to log out: name: %s logout: %s" % (name,logout))

Attempt to log out: name: admin logout: twenty-one

Attempt to log out: name: admin logout: 1                       logout: twenty-one

...
val = req['val']
unless val.respond_to?(:to_int)
  logger.info("Failed to parse val")
  logger.info(val)
end
...

INFO: Failed to parse val
INFO: twenty-one

INFO: Failed to parse val
INFO: twenty-one

INFO: User logged out=badguy

...
let num = Int(param)
if num == nil {
    NSLog("Illegal value = %@", param)
}
...

    INFO: Illegal value = twenty-one

	INFO: Illegal value=twenty-one

	INFO: User logged out=evil

...
Dim Val As Variant
Dim Value As Integer
Set Val = Request.Form("val")
If IsNumeric(Val) Then
	Set Value = Val
Else
	App.EventLog "Failed to parse val=" & Val, 1
End If
...

Failed to parse val=twenty-one

Failed to parse val=twenty-one

User logged out=badguy