540
Relevant to the view "Architectural Concepts" (CWE-1008)
Nature Type ID Name Page
MemberOf 1016 Limit Exposure 2431
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Confidentiality Read Application Data
Potential Mitigations
Phase: Implementation
Phase: Build and Compilation
Strategy = Compilation or Build Hardening
Debugging information should not make its way into a production release.
Phase: Implementation
Phase: Build and Compilation
Strategy = Environment Hardening
Debugging information should not make its way into a production release.
Demonstrative Examples
Example 1:
The following code uses custom configuration files for each user in the application. It checks to see
if the file exists on the system before attempting to open and use the file. If the configuration file
does not exist, then an error is generated, and the application exits.
Example Language: Perl (Bad)
$uname = GetUserInput("username");
# avoid CWE-22, CWE-78, others.
if ($uname !~ /^\w+$/)
{
ExitError("Bad hacker!") ;
}
$filename = "/home/myprog/config/" . $uname . ".txt";
if (!(-e $filename))
{
ExitError("Error: $filename does not exist");
}
If this code is running on a server, such as a web application, then the person making the request
should not know what the full pathname of the configuration directory is. By submitting a username
that is not associated with a configuration file, an attacker could get this pathname from the error
message. It could then be used to exploit path traversal, symbolic link following, or other problems
that may exist elsewhere in the application.
Observed Examples
Reference Description
CVE-2005-1745 Infoleak of sensitive information in error message (physical access required).
https://www.cve.org/CVERecord?id=CVE-2005-1745
MemberOf Relationships
CWE Version 4.14
CWE-211: Externally-Generated Error Message Containing Sensitive Information
CWE-211: Externally-Generated Error Message Containing Sensitive Information