1580
Scope Impact Likelihood
Attackers can leverage the additional information provided
by a default error page to mount attacks targeted on the
framework, database, or other resources used by the
application.
Demonstrative Examples
Example 1:
In the snippet below, an unchecked runtime exception thrown from within the try block may cause
the container to display its default error page (which may contain a full stack trace, among other
things).
Example Language: Java (Bad)
Public void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
try {
...
} catch (ApplicationSpecificException ase) {
logger.error("Caught: " + ase.toString());
}
}
Example 2:
The mode attribute of the <customErrors> tag in the Web.config file defines whether custom or
default error pages are used.
In the following insecure ASP.NET application setting, custom error message mode is turned off.
An ASP.NET error message with detailed stack trace and platform versions will be returned.
Example Language: ASP.NET (Bad)
<customErrors mode="Off" />
A more secure setting is to set the custom error message mode for remote users only. No
defaultRedirect error page is specified. The local user on the web server will see a detailed stack
trace. For remote users, an ASP.NET error message with the server customError configuration
setting and the platform version will be returned.
Example Language: ASP.NET (Good)
<customErrors mode="RemoteOnly" />
Another secure option is to set the mode attribute of the <customErrors> tag to use a custom page
as follows:
Example Language: ASP.NET (Good)
<customErrors mode="On" defaultRedirect="YourErrorPage.htm" />
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 884 CWE Cross-section 884 2567
MemberOf 963 SFP Secondary Cluster: Exposed Data 888 2400
CWE Version 4.14
CWE-757: Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')
CWE-757: Selection of Less-Secure Algorithm
During Negotiation ('Algorithm Downgrade')