Description
The default error page of a web application should not display sensitive information about the product.
A Web application must define a default error page for 4xx errors (e.g. 404), 5xx (e.g. 500) errors and catch java.lang.Throwable exceptions to prevent attackers from mining information from the application container's built-in error response. When an attacker explores a web site looking for vulnerabilities, the amount of information that the site provides is crucial to the eventual success or failure of any attempted attacks.
Potential Impact
Confidentiality
Read Application Data
Demonstrative Examples
Public void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {try {...} catch (ApplicationSpecificException ase) {logger.error("Caught: " + ase.toString());}}Mitigations & Prevention
Handle exceptions appropriately in source code.
Always define appropriate error pages. The application configuration should specify a default error page in order to guarantee that the application will never leak error messages to an attacker. Handling standard HTTP error codes is useful and user-friendly in addition to being a good security practice, and a good configuration will also define a last-chance error handler that catches any exception that could possibly be thrown by the application.
Do not attempt to process an error or attempt to mask it.
Verify return values are correct and do not supply sensitive information about the system.
Related Weaknesses
Taxonomy Mappings
- 7 Pernicious Kingdoms: — J2EE Misconfiguration: Missing Error Handling
Frequently Asked Questions
What is CWE-7?
CWE-7 (J2EE Misconfiguration: Missing Custom Error Page) is a software weakness identified by MITRE's Common Weakness Enumeration. It is classified as a Variant-level weakness. The default error page of a web application should not display sensitive information about the product.
How can CWE-7 be exploited?
Attackers can exploit CWE-7 (J2EE Misconfiguration: Missing Custom Error Page) to read application data. This weakness is typically introduced during the Implementation phase of software development.
How do I prevent CWE-7?
Key mitigations include: Handle exceptions appropriately in source code.
What is the severity of CWE-7?
CWE-7 is classified as a Variant-level weakness (Low-Medium abstraction). Its actual severity depends on the specific context and how the weakness manifests in your application.