CWE-779 is the mirror image of insufficient logging. The product logs so much that the files become hard to process, and recovery or forensic work suffers.
Operations teams feel it first: huge files, full disks, and a search for one useful line among millions of useless ones.
How it happens
Debug-level logging is useful during development. MITRE notes that very high levels of logging are fine at that stage, but in production they can hurt an administrator's ability to detect anomalous conditions.
Two patterns show up:
- Verbose settings left on in production, so every request writes many lines.
- Logging driven by attacker input, so one bad request writes a lot of data. The MITRE record cites CVE-2007-0421, where a server wrote a large amount of data to its log when it received malformed headers, and CVE-2002-1154, a chain where an unrestricted front end let an attacker fill the error log.
What an attacker gains
From the record:
- Denial of service. Log files can grow until they use up disk, CPU or other resources.
- Cover. Excess data can clutter the audit trail and make forensic analysis less useful.
- Missed detection. If administrators cannot process the logs, attempted attacks may go undetected.
How to find it
- Check log volume per day and per request. A sudden jump with no traffic change is a clue.
- Look for log statements inside loops, or that print whole request bodies.
- Send malformed input to a test instance and see how much it writes.
- Confirm that log levels in production are set deliberately and not left at debug.
How to fix it
- Pick log levels on purpose. Production should default to warnings and security events, with debug enabled only briefly and per component.
- Cap what any single event can log. Truncate user-supplied values before writing them.
- Rotate and compress files, and set a maximum total size so a flood cannot fill the disk.
- Rate limit repeated identical messages.
- Keep security events in a separate stream so they are not drowned by application chatter.
MAX = 200
log.warning("bad_header value=%s", header[:MAX])
The goal is balance with CWE-778: record the events that matter, with the detail that matters, and nothing more.
Quick check
How can logging be a denial of service?
If attacker-controlled input drives log volume, they can fill the disk or burn CPU on writes.
