Exposure of Sensitive System Information to an Unauthorized Control Sphere

Incomplete Base

Structure: Simple

Description

This vulnerability occurs when an application unintentionally reveals sensitive details about its underlying system, such as file paths, software versions, or environment data, to users who should not have access to that information.

Extended Description

Applications, especially web apps, run on top of complex systems like operating servers. When they generate errors, debug logs, or even normal responses, they can leak technical details—stack traces, installed packages, directory structures, or server banners. Attackers actively seek out this information to map your system's architecture and identify specific software versions with known exploits, making their attacks far more precise and dangerous. Preventing these leaks requires scrutinizing all output channels, from error messages to API headers and log files, to ensure they are sanitized before reaching an end-user. While SAST tools can flag patterns of information disclosure, managing this at scale across a large codebase is challenging. An ASPM like Plexicus helps by continuously monitoring for these exposures in production and development, using AI to prioritize the risk and suggest specific code fixes to harden your system's responses.

Common Consequences 1

Scope: Confidentiality

Impact: Read Application Data

Detection Methods 1

Automated Static AnalysisHigh

Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

Potential Mitigations 1

Phase: Architecture and DesignImplementation

Production applications should never use methods that generate internal details such as stack traces and error messages unless that information is directly committed to a log that is not viewable by the end user. All error message text should be HTML entity encoded before being written to the log file to protect against potential cross-site scripting attacks against the viewer of the logs

Demonstrative Examples 4

The following code prints the path environment variable to the standard error stream:

Code Example:Bad
C
c

ID : DX-68

This code prints all of the running processes belonging to the current user.

Code Example:

Bad

PHP

//assume getCurrentUser() returns a username that is guaranteed to be alphanumeric (avoiding CWE-78)* $userName = getCurrentUser(); $command = 'ps aux | grep ' . $userName; system($command);

If invoked by an unauthorized web user, it is providing a web page of potentially sensitive information on the underlying system, such as command-line arguments (Exposure of Sensitive System Information to an Unauthorized Control Sphere). This program is also potentially vulnerable to a PATH based attack (Untrusted Search Path), as an attacker may be able to create malicious versions of the ps or grep commands. While the program does not explicitly raise privileges to run the system commands, the PHP interpreter may by default be running with higher privileges than users.

The following code prints an exception to the standard error stream:

Code Example:Bad
Java
java

Code Example:Bad
Java
java

Depending upon the system configuration, this information can be dumped to a console, written to a log file, or exposed to a remote user. In some cases the error message tells the attacker precisely what sort of an attack the system will be vulnerable to. For example, a database error message can reveal that the application is vulnerable to a SQL injection attack. Other error messages can reveal more oblique clues about the system. In the example above, the search path could imply information about the type of operating system, the applications installed on the system, and the amount of care that the administrators have put into configuring the program.

The following code constructs a database connection string, uses it to create a new connection to the database, and prints it to the console.

Code Example:Bad
C#
c#

Depending on the system configuration, this information can be dumped to a console, written to a log file, or exposed to a remote user. In some cases the error message tells the attacker precisely what sort of an attack the system is vulnerable to. For example, a database error message can reveal that the application is vulnerable to a SQL injection attack. Other error messages can reveal more oblique clues about the system. In the example above, the search path could imply information about the type of operating system, the applications installed on the system, and the amount of care that the administrators have put into configuring the program.

Observed Examples 1

CVE-2021-32638Code analysis product passes access tokens as a command-line parameter or through an environment variable, making them visible to other processes via the ps command.

References 1

Seven Pernicious Kingdoms: A Taxonomy of Software Security Errors

Katrina Tsipenyuk, Brian Chess, and Gary McGraw

NIST Workshop on Software Security Assurance Tools Techniques and Metrics • NIST

07-11-2005

https://samate.nist.gov/SSATTM_Content/papers/Seven%20Pernicious%20Kingdoms%20-%20Taxonomy%20of%20Sw%20Security%20Errors%20-%20Tsipenyuk%20-%20Chess%20-%20McGraw.pdf

ID: REF-6

Applicable Platforms

Languages:

Not Language-Specific : Undetermined

Modes of Introduction

Implementation

Related Attack Patterns

Related Weaknesses

ChildOf:

Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)

Taxonomy Mapping

7 Pernicious Kingdoms
The CERT Oracle Secure Coding Standard for Java (2011)
Software Fault Patterns