CWE-600: Uncaught Exception in Servlet Uncaught Exception in Servlet
Weakness ID: 600 (Weakness Base) Status: Draft
Description
Description Summary
The Servlet does not catch all exceptions, which may reveal sensitive debugging information.
Extended Description
When a Servlet throws an exception, the default error response the Servlet container sends back to the user typically includes debugging information. This information is of great value to an attacker . For example, a stack trace might show the attacker a malformed SQL query string, the type of database being used, and the version of the application container. This information enables the attacker to target known vulnerabilities in these components.
Alternate Terms
Time of Introduction
Common Consequences
Scope Effect Confidentiality
Availability
Technical Impact: Read application
data; DoS: crash / exit /
restart
Demonstrative Examples
Example 1
In the following method a DNS lookup failure will cause the Servlet
to throw an exception.
(Bad Code)
Example
Language: Java
protected void doPost (HttpServletRequest req, HttpServletResponse
res) throws IOException {
String ip = req.getRemoteAddr();
InetAddress addr = InetAddress.getByName(ip);
...
out.println("hello " + addr.getHostName());
}
Potential Mitigations
Implement Exception blocks to handle all types of Exceptions.
Relationships
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name CERT Java Secure Coding ERR01-J Do not allow exceptions to expose sensitive
information
Maintenance Notes
The "Missing Catch Block" concept is probably broader than just Servlets,
but the broader concept is not sufficiently covered in CWE.
Content History
Modifications Modification Date Modifier Organization Source 2008-07-01 Eric Dalci Cigital External updated Potential_Mitigations,
Time_of_Introduction 2008-09-08 CWE Content Team MITRE Internal updated Relationships, Other_Notes 2009-03-10 CWE Content Team MITRE Internal updated Alternate_Terms, Description, Maintenance_Notes,
Name, Other_Notes, Relationships 2009-05-27 CWE Content Team MITRE Internal updated Demonstrative_Examples 2010-12-13 CWE Content Team MITRE Internal updated Description, Name 2011-03-29 CWE Content Team MITRE Internal updated Relationships 2011-06-01 CWE Content Team MITRE Internal updated Common_Consequences, Relationships,
Taxonomy_Mappings Previous Entry Names Change Date Previous Entry
Name 2008-04-11 Missing Catch
Block 2009-03-10 Failure to Catch All
Exceptions (Missing Catch Block) 2010-12-13 Failure to Catch All
Exceptions in Servlet
Description
