Description
The software generates an error message that includes sensitive information about its environment, users, or associated data.
Modes of Introduction:
– Architecture and Design
Likelihood of Exploit: High
Related Weaknesses
Consequences
Confidentiality: Read Application Data
Often this will either reveal sensitive information which may be used for a later attack or private information stored in the server.
Potential Mitigations
Phase: Implementation
Description:
Phase: Implementation
Description:
Handle exceptions internally and do not display errors containing potentially sensitive information to a user.
Phase: Implementation
Effectiveness: Defense in Depth
Description:
Use naming conventions and strong types to make it easier to spot when sensitive data is being used. When creating structures, objects, or other complex entities, separate the sensitive and non-sensitive data as much as possible.
This makes it easier to spot places in the code where data is being used that is unencrypted.
Phase: Implementation, Build and Compilation
Description:
Debugging information should not make its way into a production release.
Phase: Implementation, Build and Compilation
Description:
Debugging information should not make its way into a production release.
Phase: System Configuration
Description:
Where available, configure the environment to use less verbose error messages. For example, in PHP, disable the display_errors setting during configuration, or at runtime using the error_reporting() function.
Phase: System Configuration
Description:
Create default error pages or messages that do not leak any information.
CVE References
- CVE-2008-2049
- POP3 server reveals a password in an error message after multiple APOP commands are sent. Might be resultant from another weakness.
- CVE-2007-5172
- Program reveals password in error message if attacker can trigger certain database errors.
- CVE-2008-4638
- Composite: application running with high privileges (CWE-250) allows user to specify a restricted file to process, which generates a parsing error that leaks the contents of the file (CWE-209).
- CVE-2008-1579
- Existence of user names can be determined by requesting a nonexistent blog and reading the error message.
- CVE-2007-1409
- Direct request to library file in web application triggers pathname leak in error message.
- CVE-2008-3060
- Malformed input to login page causes leak of full path when IMAP call fails.
- CVE-2005-0603
- Malformed regexp syntax leads to information exposure in error message.
- CVE-2017-9615
- verbose logging stores admin credentials in a world-readablelog file
- CVE-2018-1999036
- SSH password for private key stored in build log