CWE-211: Information Exposure Through External Error Message
Information Exposure Through External Error Message
Weakness ID: 211 (Weakness Base)
Status: Incomplete
Description
Description Summary
The software performs an operation that triggers an external diagnostic or error message that is not directly generated by the software, such as an error generated by the programming language interpreter that the software uses. The error can contain sensitive system information.
Time of Introduction
Architecture and Design
Implementation
Operation
Applicable Platforms
Languages
PHP: (Often)
All
Common Consequences
Scope
Effect
Confidentiality
Technical Impact: Read application
data
Enabling Factors for Exploitation
PHP applications are often targeted for having this issue when the PHP
interpreter generates the error outside of the application's control.
However, it's not just restricted to PHP, as other languages/environments
exhibit the same issue.
chain: product does not protect against direct
request of an include file, leading to resultant path disclosure when the
include file does not successfully execute.
Single "'" inserted into SQL query leads to
invalid SQL query execution, triggering full path disclosure. Possibly
resultant from more general SQL injection
issue.
chain: product does not protect against direct
request of a library file, leading to resultant path disclosure when the
file does not successfully execute.
Various invalid requests lead to information leak
in verbose error messages describing the failure to instantiate a class,
open a configuration file, or execute an undefined
function.
Improper handling of filename request with
trailing "/" causes multiple consequences, including information leak in
Visual Basic error message.
Potential Mitigations
Phase: System Configuration
Configure the application's environment in a way that prevents errors
from being generated. For example, in PHP, disable
display_errors.
Phases: Implementation; Build and Compilation
Strategies: Compilation or Build Hardening; Environment Hardening
Debugging information should not make its way into a production
release.
Phase: Implementation
Handle exceptions internally and do not display errors containing
potentially sensitive information to a user. Create default error pages
if necessary.
Phase: Implementation
The best way to prevent this weakness during implementation is to
avoid any bugs that could trigger the external error message. This
typically happens when the program encounters fatal errors, such as a
divide-by-zero. You will not always be able to control the use of error
pages, and you might not be using a language that handles
exceptions.
Weakness Ordinalities
Ordinality
Description
Resultant
(where
the weakness is typically related to the presence of some other
weaknesses)
Description
