The software provides different responses to incoming requests
in a way that allows an actor to determine system state information that is
outside of that actor's control sphere.
Extended Description
This issue frequently occurs during authentication, where a difference in
failed-login messages could allow an attacker to determine if the username
is valid or not. These leaks can be inadvertent (bug) or intentional
(design).
Compartmentalize your system to have "safe" areas where trust
boundaries can be unambiguously drawn. Do not allow sensitive data to go
outside of the trust boundary and always be careful when interfacing
with a compartment outside of the safe area.
Architecture and Design
Setup generic response for error conditions. The error page should not
disclose information about the success or failure of a sensitive
operation. For instance, the login page should not confirm that the
login is correct and the password incorrect. The attacker who tries
random account name may be able to guess some of them. Confirming that
the account exists would make the login page more susceptible to brute
force attack.
Description
