Expected Findings
- Audit endpoint stores client-supplied `ts` field as truth.
- `actor` is taken from the body rather than the session.
- Newlines in `action` are not escaped, enabling log injection.
Audit Log
Audit Log Tamper
The audit log writer accepts client-supplied timestamps, user IDs, and action labels, so any caller can backdate events or impersonate other users in the log.
CWE-117CWE-345
Audit probe
Primary Flows
- Append entry Client controls actor/ts
- Recent entries Tampered events visible
Signals
Code
db.audit.insert({ts: req.body.ts, actor: req.body.actor, ...})