CWE-209: Generation of Error Message Containing Sensitive Information

What is Generation of Error Message Containing Sensitive Information?

• Overview: This vulnerability occurs when a software application generates error messages that contain sensitive information about the system, users, or data. These messages can unintentionally expose valuable details to attackers, which may aid in launching more targeted attacks.

• Exploitation Methods:

• Attackers can exploit this vulnerability by intentionally triggering errors and analyzing the resulting messages for sensitive information.
• Common attack patterns include inducing errors through malformed inputs, such as SQL injection attempts, to extract information like database structure or application paths.

• Security Impact:

• Direct consequences include disclosure of sensitive information such as file paths, database queries, or user data.
• Potential cascading effects include facilitating further attacks like SQL injection, path traversal, or gaining unauthorized access.
• Business impact may include data breaches, loss of customer trust, and compliance violations, leading to financial and reputational damage.

• Prevention Guidelines:

• Specific code-level fixes include sanitizing error messages to ensure they do not contain sensitive information and using generic error messages for users.
• Security best practices involve implementing proper error handling mechanisms, logging detailed errors securely, and only displaying general error information to end-users.
• Recommended tools and frameworks include using application security testing tools to identify and address error handling vulnerabilities and leveraging security-focused libraries that provide safe error management.

Corgea can automatically detect and fix Generation of Error Message Containing Sensitive Information in your codebase. [Try Corgea free today](https://corgea.app).

Technical Details

Likelihood of Exploit: High

Affected Languages: PHP, Java, Not Language-Specific

Affected Technologies: Not specified

Vulnerable Code Example

PHP Example

// This code generates detailed error messages that could expose sensitive information such as file paths, database queries, or stack traces.
function handleError(\$errno, \$errstr, \$errfile, \$errline) {
    // Outputting full error details to the end-user
    echo "Error: [\$errno] \$errstr in \$errfile on line \$errline";  // This line exposes sensitive information that could help an attacker understand the application's structure and potential vulnerabilities.
}

set_error_handler("handleError");

Explanation

• Line 6-8: The code outputs detailed error information directly to the user. This includes the error number, error string, file name, and line number, which can reveal sensitive information about the application's structure and help an attacker in exploiting vulnerabilities.

How to fix Generation of Error Message Containing Sensitive Information?

To fix this vulnerability, the application should not expose detailed error messages to end-users. Instead, error messages should be logged to a secure location that is accessible only to developers or system administrators.

The best practice is to:

1. Display a generic error message to the user.
2. Log detailed error information to a file or error management system.
3. Ensure that the error logs are stored securely and only accessible to authorized personnel.

By implementing these practices, sensitive information is protected from being disclosed to potential attackers, while still allowing developers to troubleshoot issues using the detailed logs.

Fixed Code Example

// This code securely logs detailed error information while displaying a generic message to users.
function handleError(\$errno, \$errstr, \$errfile, \$errline) {
    // Log the detailed error message to a secure log file
    error_log("Error: [\$errno] \$errstr in \$errfile on line \$errline", 3, "/var/log/app_errors.log");
    
    // Display a generic error message to the user
    echo "An unexpected error occurred. Please try again later.";
    
    // Note: Detailed error information is logged and not exposed to the end-user
}

set_error_handler("handleError");

Explanation

• Line 6: The detailed error message is now logged to a file instead of being displayed to the user. Ensure the log file, /var/log/app_errors.log, has appropriate permissions to prevent unauthorized access.
• Line 9: A generic error message is provided to the user, avoiding the exposure of internal system details. This helps in maintaining security by not revealing potential vulnerabilities to end-users.

Best Practices

• Ensure that error logging is performed in a secure manner, with log files being accessible only to authorized personnel.
• Use a centralized error management system if possible, to better monitor and manage error logs.
• Regularly review and rotate log files to prevent unauthorized access and manage disk space effectively.