1195
Example 2:
This code prints all of the running processes belonging to the current user.
Example Language: PHP (Bad)
//assume getCurrentUser() returns a username that is guaranteed to be alphanumeric (avoiding CWE-78)
$userName = getCurrentUser();
$command = 'ps aux | grep ' . $userName;
system($command);
If invoked by an unauthorized web user, it is providing a web page of potentially sensitive
information on the underlying system, such as command-line arguments (CWE-497). This program
is also potentially vulnerable to a PATH based attack (CWE-426), as an attacker may be able to
create malicious versions of the ps or grep commands. While the program does not explicitly raise
privileges to run the system commands, the PHP interpreter may by default be running with higher
privileges than users.
Example 3:
The following code prints an exception to the standard error stream:
Example Language: Java (Bad)
try {
...
} catch (Exception e) {
e.printStackTrace();
}
Example Language: (Bad)
try {
...
} catch (Exception e) {
Console.Writeline(e);
}
Depending upon the system configuration, this information can be dumped to a console, written to
a log file, or exposed to a remote user. In some cases the error message tells the attacker precisely
what sort of an attack the system will be vulnerable to. For example, a database error message
can reveal that the application is vulnerable to a SQL injection attack. Other error messages can
reveal more oblique clues about the system. In the example above, the search path could imply
information about the type of operating system, the applications installed on the system, and the
amount of care that the administrators have put into configuring the program.
Example 4:
The following code constructs a database connection string, uses it to create a new connection to
the database, and prints it to the console.
Example Language: C# (Bad)
string cs="database=northwind; server=mySQLServer...";
SqlConnection conn=new SqlConnection(cs);
...
Console.Writeline(cs);
Depending on the system configuration, this information can be dumped to a console, written to a
log file, or exposed to a remote user. In some cases the error message tells the attacker precisely
what sort of an attack the system is vulnerable to. For example, a database error message can
reveal that the application is vulnerable to a SQL injection attack. Other error messages can
reveal more oblique clues about the system. In the example above, the search path could imply
CWE Version 4.14
CWE-498: Cloneable Class Containing Sensitive Information
CWE-498: Cloneable Class Containing Sensitive Information