CWE-209: Generation of Error Message Containing Sensitive Information

Description

The product generates an error message that includes sensitive information about its environment, users, or associated data.

Potential Impact

Demonstrative Examples

try {/.../}catch (Exception e) {System.out.println(e);}

try {openDbConnection();}
                     //print exception message that includes exception message and configuration file location
                     catch (Exception $e) {echo 'Caught exception: ', $e->getMessage(), '\n';echo 'Check credentials in config file at: ', $Mysql_config_location, '\n';}

$ConfigDir = "/home/myprog/config";$uname = GetUserInput("username");
                     
                     # avoid CWE-22, CWE-78, others.
                     ExitError("Bad hacker!") if ($uname !~ /^\w+$/);$file = "$ConfigDir/$uname.txt";if (! (-e $file)) {ExitError("Error: $file does not exist");}...

public BankAccount getUserBankAccount(String username, String accountNumber) {
                        BankAccount userAccount = null;String query = null;try {if (isAuthorizedUser(username)) {query = "SELECT * FROM accounts WHERE owner = "+ username + " AND accountID = " + accountNumber;DatabaseManager dbManager = new DatabaseManager();Connection conn = dbManager.getConnection();Statement stmt = conn.createStatement();ResultSet queryResult = stmt.executeQuery(query);userAccount = (BankAccount)queryResult.getObject(accountNumber);}} catch (SQLException ex) {String logMessage = "Unable to retrieve account information from database,\nquery: " + query;Logger.getLogger(BankManager.class.getName()).log(Level.SEVERE, logMessage, ex);}return userAccount;
                     }

Mitigations & Prevention

Detection Methods

• Manual Analysis High — This weakness generally requires domain-specific interpretation using manual analysis. However, the number of potential error conditions may be too large to cover completely within limited time constraints.
• Automated Analysis Moderate — Automated methods may be able to detect certain idioms automatically, such as exposed stack traces or pathnames, but violation of business rules or privacy requirements is not typically feasible.
• Automated Dynamic Analysis Moderate — This weakness can be detected using dynamic tools and techniques that interact with the software using large test suites with many diverse inputs, such as fuzz testing (fuzzing), robustness testing, and fault injection. The software's operation may slow down, but it should not become unstable, crash
• Manual Dynamic Analysis — Identify error conditions that are not likely to occur during normal usage and trigger them. For example, run the program under low memory conditions, run with insufficient privileges or permissions, interrupt a transaction before it is completed, or disable connectivity to basic network services su
• Automated Static Analysis — Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then sea

Real-World CVE Examples

Related Weaknesses

Taxonomy Mappings

• CLASP: — Accidental leaking of sensitive information through error messages
• OWASP Top Ten 2007: A6 — Information Leakage and Improper Error Handling
• OWASP Top Ten 2004: A7 — Improper Error Handling
• OWASP Top Ten 2004: A10 — Insecure Configuration Management
• The CERT Oracle Secure Coding Standard for Java (2011): ERR01-J — Do not allow exceptions to expose sensitive information
• Software Fault Patterns: SFP23 — Exposed Data