Java Runtime Error Message Containing Sensitive Information
This vulnerability occurs when a Java application's runtime error messages reveal sensitive details about the system, such as file paths, internal IP addresses, or stack traces. Attackers can exploit these overly informative error messages to map the application's structure and gather intelligence for further attacks.
When an unhandled exception occurs, the default behavior in many Java applications is to display a detailed error message to the user. These messages often contain internal data like server file system paths, database connection strings, library versions, or configuration details. This information is invaluable to an attacker, as it helps them understand the underlying technology stack and pinpoint weaknesses without needing to probe the system directly. To prevent this, developers should implement a global exception handler that catches all unhandled exceptions and replaces verbose system-generated messages with generic, user-friendly ones. All detailed error information should be logged securely on the server side for debugging purposes, never exposed to the end-user. This practice, often called 'security through obscurity,' is a critical layer in a defense-in-depth strategy, ensuring that failures don't inadvertently hand attackers a roadmap to your system.
Impact: Read Application Data
ID : DX-191
In the following Java example the class InputFileRead enables an input file to be read using a FileReader object. In the constructor of this class a default input file path is set to some directory on the local file system and the method setInputFile must be called to set the name of the input file to be read in the default directory. The method readInputFile will create the FileReader object and will read the contents of the file. If the method setInputFile is not called prior to calling the method readInputFile then the File object will remain null when initializing the FileReader object. A Java RuntimeException will be raised, and an error message will be output to the user.Code Example:
java/* Assume appropriate validation / encoding is used and privileges / permissions are preserved / }
javaCode Example:
java// Get username and password from login page request* String username = request.getParameter("username"); String password = request.getParameter("password");
javajava// output failed login message to error page* request.setAttribute("error", new String("Login Error")); request.setAttribute("message", ex.getMessage()); getServletContext().getRequestDispatcher("/ErrorPage.jsp").forward(request, response);}}