CWE-536: Information Exposure Through Servlet Runtime Error Message
Information Exposure Through Servlet Runtime Error Message
Weakness ID: 536 (Weakness Variant)
Status: Incomplete
Description
Description Summary
A servlet error message indicates that there exists an unhandled exception in your web application code and may provide useful information to an attacker.
Time of Introduction
Implementation
Common Consequences
Scope
Effect
Confidentiality
Technical Impact: Read application
data
The error message may contain the location of the file in which the
offending function is located. This may disclose the web root's absolute
path as well as give the attacker the location of application files or
configuration information. It may even disclose the portion of code that
failed. In many cases, an attacker can use the data to launch further
attacks against the system.
Demonstrative Examples
Example 1
The following servlet code does not catch runtime exceptions,
meaning that if such an exception were to occur, the container may display
potentially dangerous information (such as a full stack trace).
(Bad Code)
Example
Language: Java
public void doPost(HttpServletRequest request, HttpServletResponse
response) throws ServletException, IOException {
Description
