209 (Weakness Base)

High

Confidentiality: Often this will either reveal sensitive information which may be used for a later attack or private information stored in the server.

Design: When an application detects illegal input, error messages should only provide generic feedback, such as "Illegal characters were detected." Messages should provide few, if any, implementation details.

Implementation: Any error should be parsed for dangerous revelations.

Build: Debugging information should not make its way into a production release.

Handle exceptions internally and do not display errors containing potentially sensitive information to a user. Create default error pages if necessary.

Java Example:

Here you are passing much more data than is needed. Another example is passing the SQL exceptions to a WebUser without filtering.

Error messages should not provide attackers with any implementation details when the application detects an illegal action. This includes indicating exactly what is allowable, or exactly what was illegal about the user input. Such detailed information can help an attacker craft another attack that now will pass through the validation filters.

The first thing an attacker may use -- once an attack has failed -- to stage the next attack is the error information provided by the server. SQL Injection attacks generally probe the server for information in order to stage a successful attack.

CLASP - Accidental leaking of sensitive information through error messages

All