CWE-211: Product-External Error Message Information Leak
Product-External Error Message Information Leak
Weakness ID: 211 (Weakness Base)
Status: Incomplete
Description
Description Summary
The software performs an operation that triggers an external
diagnostic or error message that is not directly generated by the software, such
as an error generated by the programming language interpreter that the software
uses. The error can contain sensitive system information.
Time of Introduction
Architecture and Design
Implementation
Operation
Applicable Platforms
Languages
PHP: (Often)
All
Enabling Factors for Exploitation
PHP applications are often targeted for having this issue when the PHP
interpreter generates the error outside of the application's control.
However, it's not just restricted to PHP, as other languages/environments
exhibit the same issue.
chain: product does not protect against direct
request of an include file, leading to resultant path disclosure when the
include file does not successfully execute.
Single "'" inserted into SQL query leads to
invalid SQL query execution, triggering full path disclosure. Possibly
resultant from more general SQL injection
issue.
chain: product does not protect against direct
request of a library file, leading to resultant path disclosure when the
file does not successfully execute.
Various invalid requests lead to information leak
in verbose error messages describing the failure to instantiate a class,
open a configuration file, or execute an undefined
function.
Failure to handle filename request with trailing
"/" causes multiple consequences, including information leak in Visual Basic
error message.
Potential Mitigations
Phase
Description
System Configuration
Configure the application's environment in a way that prevents errors
from being generated. For example, in PHP, disable
display_errors.
Build and Compilation
Debugging information should not make its way into a production
release.
Implementation
Handle exceptions internally and do not display errors containing
potentially sensitive information to a user. Create default error pages
if necessary.
Implementation
The best way to prevent this weakness during implementation is to
avoid any bugs that could trigger the external error message. This
typically happens when the program encounters fatal errors, such as a
divide-by-zero. You will not always be able to control the use of error
pages, and you might not be using a language that handles
exceptions.
Weakness Ordinalities
Ordinality
Description
Resultant
(where the
weakness is typically related to the presence of some other
weaknesses)
Description
