CWE-215: Information Leak Through Debug Information
Information Leak Through Debug Information
Weakness ID: 215 (Weakness Variant) Status: Draft
Description
Description Summary
The application contains debugging code that can leak sensitive
information to untrusted parties.
Time of Introduction
Architecture and Design
Implementation
Operation
Demonstrative Examples
Example 1
The following code reads a "debugEnabled" system property and writes
sensitive debug information to the client browser if true.
(Bad Code)
JSP
<% if (Boolean.getBoolean("debugEnabled")) {
%>
User account number: <%= acctNo %>
<%
} %>
Observed Examples
Reference Description CVE-2004-2268 Debug information infoleak of
password. CVE-2002-0918 CGI script includes sensitive information in debug
messages when an error is triggered. CVE-2003-1078 FTP client with debug option enabled shows
password to the screen.
Potential Mitigations
Phase Description Do not leave debug statements that could be executed in the source
code. Assure that all debug information is eradicated before releasing
the software.
Architecture and Design
Compartmentalize your system to have "safe" areas where trust
boundaries can be unambiguously drawn. Do not allow sensitive data to go
outside of the trust boundary and always be careful when interfacing
with a compartment outside of the safe area.
Relationships
Relationship Notes
This overlaps other categories.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name PLOVER Infoleak Using Debug Information OWASP Top Ten 2007 A6 CWE More Specific Information Leakage and Improper Error
Handling OWASP Top Ten 2004 A10 CWE More Specific Insecure Configuration Management
Content History
Submissions Submission Date Submitter Organization Source PLOVER Externally Mined Modifications Modification Date Modifier Organization Source 2008-07-01 Sean Eidemiller Cigital External added/updated demonstrative
examples 2008-07-01 Eric Dalci Cigital External updated Time of Introduction 2008-08-15 Veracode External Suggested OWASP Top Ten 2004
mapping 2008-09-08 CWE Content Team MITRE Internal updated Relationships, Relationship Notes,
Taxonomy Mappings 2009-05-27 CWE Content Team MITRE Internal updated Demonstrative Examples
Description
