546
Phase: Implementation
Strategy = Attack Surface Reduction
Use naming conventions and strong types to make it easier to spot when sensitive data is being
used. When creating structures, objects, or other complex entities, separate the sensitive and
non-sensitive data as much as possible.
Effectiveness = Defense in Depth
This makes it easier to spot places in the code where data is being used that is unencrypted.
Phase: Implementation
Avoid errors related to improper resource shutdown or release (CWE-404), which may leave the
sensitive data within the resource if it is in an incomplete state.
Demonstrative Examples
Example 1:
This code either generates a public HTML user information page or a JSON response containing
the same user information.
Example Language: PHP (Bad)
// API flag, output JSON if set
$json = $_GET['json']
$username = $_GET['user']
if(!$json)
{
$record = getUserRecord($username);
foreach($record as $fieldName => $fieldValue)
{
if($fieldName == "email_address") {
// skip displaying user emails
continue;
}
else{
writeToHtmlPage($fieldName,$fieldValue);
}
}
}
else
{
$record = getUserRecord($username);
echo json_encode($record);
}
The programmer is careful to not display the user's e-mail address when displaying the public
HTML page. However, the e-mail address is not removed from the JSON response, exposing the
user's e-mail address.
Observed Examples
Reference Description
CVE-2019-3733 Cryptography library does not clear heap memory before release
https://www.cve.org/CVERecord?id=CVE-2019-3733
CVE-2005-0406 Some image editors modify a JPEG image, but the original EXIF thumbnail
image is left intact within the JPEG. (Also an interaction error).
https://www.cve.org/CVERecord?id=CVE-2005-0406
CVE-2002-0704 NAT feature in firewall leaks internal IP addresses in ICMP error messages.
https://www.cve.org/CVERecord?id=CVE-2002-0704
MemberOf Relationships
CWE Version 4.14
CWE-213: Exposure of Sensitive Information Due to Incompatible Policies
CWE-213: Exposure of Sensitive Information Due to Incompatible Policies