Dear all,

I found that chartmuseum (v0.13.1) accepts %0a in URLs and forwards this character (newline) to logfiles, which allows attackers to inject custom logfile messages.

PoC

wget http://<hostname>/ind%0aex.yaml

inserts a newline between ind and ex.yaml in the logfile. An attacker can insert information such as "user 'XYZ' has been logged out" prior to perform malicious activity, to cover his traces.

Additional Information

https://capec.mitre.org/data/definitions/93.html