Tag Archives: CWE- 209

CWE-209 – Generation of Error Message Containing Sensitive Information

Read Time:2 Minute, 1 Second

Description

The software generates an error message that includes sensitive information about its environment, users, or associated data.

Modes of Introduction:

– Architecture and Design

 

Likelihood of Exploit: High

 

Related Weaknesses

CWE-200
CWE-200
CWE-755

 

Consequences

Confidentiality: Read Application Data

Often this will either reveal sensitive information which may be used for a later attack or private information stored in the server.

 

Potential Mitigations

Phase: Implementation

Description: 

Phase: Implementation

Description: 

Handle exceptions internally and do not display errors containing potentially sensitive information to a user.

Phase: Implementation

Effectiveness: Defense in Depth

Description: 

Use naming conventions and strong types to make it easier to spot when sensitive data is being used. When creating structures, objects, or other complex entities, separate the sensitive and non-sensitive data as much as possible.

This makes it easier to spot places in the code where data is being used that is unencrypted.

Phase: Implementation, Build and Compilation

Description: 

Debugging information should not make its way into a production release.

Phase: Implementation, Build and Compilation

Description: 

Debugging information should not make its way into a production release.

Phase: System Configuration

Description: 

Where available, configure the environment to use less verbose error messages. For example, in PHP, disable the display_errors setting during configuration, or at runtime using the error_reporting() function.

Phase: System Configuration

Description: 

Create default error pages or messages that do not leak any information.

CVE References

  • CVE-2008-2049
    • POP3 server reveals a password in an error message after multiple APOP commands are sent. Might be resultant from another weakness.
  • CVE-2007-5172
    • Program reveals password in error message if attacker can trigger certain database errors.
  • CVE-2008-4638
    • Composite: application running with high privileges (CWE-250) allows user to specify a restricted file to process, which generates a parsing error that leaks the contents of the file (CWE-209).
  • CVE-2008-1579
    • Existence of user names can be determined by requesting a nonexistent blog and reading the error message.
  • CVE-2007-1409
    • Direct request to library file in web application triggers pathname leak in error message.
  • CVE-2008-3060
    • Malformed input to login page causes leak of full path when IMAP call fails.
  • CVE-2005-0603
    • Malformed regexp syntax leads to information exposure in error message.
  • CVE-2017-9615
    • verbose logging stores admin credentials in a world-readablelog file