537
if (! (-e $file)) {
ExitError("Error: $file does not exist");
}
...
If this code is running on a server, such as a web application, then the person making the request
should not know what the full pathname of the configuration directory is. By submitting a username
that does not produce a $file that exists, an attacker could get this pathname. It could then be
used to exploit path traversal or symbolic link following problems that may exist elsewhere in the
application.
Example 4:
In the example below, the method getUserBankAccount retrieves a bank account object from
a database using the supplied username and account number to query the database. If an
SQLException is raised when querying the database, an error message is created and output to a
log file.
Example Language: Java (Bad)
public BankAccount getUserBankAccount(String username, String accountNumber) {
BankAccount userAccount = null;
String query = null;
try {
if (isAuthorizedUser(username)) {
query = "SELECT * FROM accounts WHERE owner = "
+ username + " AND accountID = " + accountNumber;
DatabaseManager dbManager = new DatabaseManager();
Connection conn = dbManager.getConnection();
Statement stmt = conn.createStatement();
ResultSet queryResult = stmt.executeQuery(query);
userAccount = (BankAccount)queryResult.getObject(accountNumber);
}
} catch (SQLException ex) {
String logMessage = "Unable to retrieve account information from database,\nquery: " + query;
Logger.getLogger(BankManager.class.getName()).log(Level.SEVERE, logMessage, ex);
}
return userAccount;
}
The error message that is created includes information about the database query that may contain
sensitive information about the database or query logic. In this case, the error message will expose
the table name and column names used in the database. This data could be used to simplify other
attacks, such as SQL injection (CWE-89) to directly access the database.
Observed Examples
Reference Description
CVE-2008-2049 POP3 server reveals a password in an error message after multiple APOP
commands are sent. Might be resultant from another weakness.
https://www.cve.org/CVERecord?id=CVE-2008-2049
CVE-2007-5172 Program reveals password in error message if attacker can trigger certain
database errors.
https://www.cve.org/CVERecord?id=CVE-2007-5172
CVE-2008-4638 Composite: application running with high privileges (CWE-250) allows user to
specify a restricted file to process, which generates a parsing error that leaks
the contents of the file (CWE-209).
https://www.cve.org/CVERecord?id=CVE-2008-4638
CVE-2008-1579 Existence of user names can be determined by requesting a nonexistent blog
and reading the error message.
https://www.cve.org/CVERecord?id=CVE-2008-1579
CWE Version 4.14
CWE-209: Generation of Error Message Containing Sensitive Information
CWE-209: Generation of Error Message Containing Sensitive Information