536
Strategy = Environment Hardening
Debugging information should not make its way into a production release.
Phase: System Configuration
Where available, configure the environment to use less verbose error messages. For example,
in PHP, disable the display_errors setting during configuration, or at runtime using the
error_reporting() function.
Phase: System Configuration
Create default error pages or messages that do not leak any information.
Demonstrative Examples
Example 1:
In the following example, sensitive information might be printed depending on the exception that
occurs.
Example Language: Java (Bad)
try {
/.../
}
catch (Exception e) {
System.out.println(e);
}
If an exception related to SQL is handled by the catch, then the output might contain sensitive
information such as SQL query structure or private information. If this output is redirected to a web
user, this may represent a security problem.
Example 2:
This code tries to open a database connection, and prints any exceptions that occur.
Example Language: PHP (Bad)
try {
openDbConnection();
}
//print exception message that includes exception message and configuration file location
catch (Exception $e) {
echo 'Caught exception: ', $e->getMessage(), '\n';
echo 'Check credentials in config file at: ', $Mysql_config_location, '\n';
}
If an exception occurs, the printed message exposes the location of the configuration file the script
is using. An attacker can use this information to target the configuration file (perhaps exploiting a
Path Traversal weakness). If the file can be read, the attacker could gain credentials for accessing
the database. The attacker may also be able to replace the file with a malicious one, causing the
application to use an arbitrary database.
Example 3:
The following code generates an error message that leaks the full pathname of the configuration
file.
Example Language: Perl (Bad)
$ConfigDir = "/home/myprog/config";
$uname = GetUserInput("username");
# avoid CWE-22, CWE-78, others.
ExitError("Bad hacker!") if ($uname !~ /^\w+$/);
$file = "$ConfigDir/$uname.txt";
CWE Version 4.14
CWE-209: Generation of Error Message Containing Sensitive Information
CWE-209: Generation of Error Message Containing Sensitive Information