Externally-Generated Error Message Containing Sensitive Information

Description

This vulnerability occurs when an application triggers an error message from an external component—like a database, interpreter, or operating system—and that error reveals sensitive details about the system's internal workings, configuration, or data.

Extended Description

Unlike application-controlled errors, these messages originate from underlying platforms or dependencies and often include technical details developers didn't intend to expose. Attackers can deliberately trigger these errors by sending malformed inputs or causing system failures, then harvest information like stack traces, file paths, database schemas, or server versions to plan further attacks. Preventing this requires a defense-in-depth approach: configure external components to suppress verbose errors in production, implement centralized exception handling to catch and sanitize all external messages before they reach users, and ensure logging systems capture detailed diagnostics separately without exposing them through user interfaces. Regular testing with fuzzing and penetration testing helps identify what information leaks through these indirect channels.

Common Consequences 1

Scope: Confidentiality

Impact: Read Application Data

Potential Mitigations 5

Phase: System Configuration

Configure the application's environment in a way that prevents errors from being generated. For example, in PHP, disable display_errors.

Phase: ImplementationBuild and Compilation

Strategy: Compilation or Build Hardening

Debugging information should not make its way into a production release.

Phase: ImplementationBuild and Compilation

Strategy: Environment Hardening

Debugging information should not make its way into a production release.

Phase: Implementation

Handle exceptions internally and do not display errors containing potentially sensitive information to a user. Create default error pages if necessary.

Phase: Implementation

The best way to prevent this weakness during implementation is to avoid any bugs that could trigger the external error message. This typically happens when the program encounters fatal errors, such as a divide-by-zero. You will not always be able to control the use of error pages, and you might not be using a language that handles exceptions.

Demonstrative Examples 2

ID : DX-190

The following servlet code does not catch runtime exceptions, meaning that if such an exception were to occur, the container may display potentially dangerous information (such as a full stack trace).

Code Example:

Bad

Java

java

// May cause unchecked NullPointerException.* if (username.length() < 10) { ``` ... } }

ID : DX-191

In the following Java example the class InputFileRead enables an input file to be read using a FileReader object. In the constructor of this class a default input file path is set to some directory on the local file system and the method setInputFile must be called to set the name of the input file to be read in the default directory. The method readInputFile will create the FileReader object and will read the contents of the file. If the method setInputFile is not called prior to calling the method readInputFile then the File object will remain null when initializing the FileReader object. A Java RuntimeException will be raised, and an error message will be output to the user.

Code Example:

Bad

Java

java

/* Assume appropriate validation / encoding is used and privileges / permissions are preserved / }

java

However, the error message output to the user contains information regarding the default directory on the local file system. This information can be exploited and may lead to unauthorized access or use of the system. Any Java RuntimeExceptions that are handled should not expose sensitive information to the user.

Observed Examples 6

CVE-2004-1581chain: product does not protect against direct request of an include file, leading to resultant path disclosure when the include file does not successfully execute.

CVE-2004-1579Single "'" inserted into SQL query leads to invalid SQL query execution, triggering full path disclosure. Possibly resultant from more general SQL injection issue.

CVE-2005-0459chain: product does not protect against direct request of a library file, leading to resultant path disclosure when the file does not successfully execute.

CVE-2005-0443invalid parameter triggers a failure to find an include file, leading to infoleak in error message.

CVE-2005-0433Various invalid requests lead to information leak in verbose error messages describing the failure to instantiate a class, open a configuration file, or execute an undefined function.

CVE-2004-1101Improper handling of filename request with trailing "/" causes multiple consequences, including information leak in Visual Basic error message.

Applicable Platforms

Languages:

PHP : OftenNot Language-Specific : Undetermined

Modes of Introduction

Architecture and Design

Implementation

Operation

Functional Areas

Error Handling

Related Weaknesses

ChildOf:

Generation of Error Message Containing Sensitive Information (CWE-209)

Taxonomy Mapping

PLOVER

Notes

RelationshipThis is inherently a resultant vulnerability from a weakness within the product or an interaction error.