Exécuter une analyse statique (SAST) sur le code source à la recherche du motif non sécurisé dans le flux de données.
CWE-211 Base Incomplet
Externally-Generated Error Message Containing Sensitive Information
This vulnerability occurs when an application triggers an error message from an external component—like a database, interpreter, or operating system—and that error reveals sensitive details about…
Définition
What is CWE-211?
This vulnerability occurs when an application triggers an error message from an external component—like a database, interpreter, or operating system—and that error reveals sensitive details about the system's internal workings, configuration, or data.
Unlike application-controlled errors, these messages originate from underlying platforms or dependencies and often include technical details developers didn't intend to expose. Attackers can deliberately trigger these errors by sending malformed inputs or causing system failures, then harvest information like stack traces, file paths, database schemas, or server versions to plan further attacks.
Preventing this requires a defense-in-depth approach: configure external components to suppress verbose errors in production, implement centralized exception handling to catch and sanitize all external messages before they reach users, and ensure logging systems capture detailed diagnostics separately without exposing them through user interfaces. Regular testing with fuzzing and penetration testing helps identify what information leaks through these indirect channels.
Impact réel
Real-world CVEs caused by CWE-211
-
chain: product does not protect against direct request of an include file, leading to resultant path disclosure when the include file does not successfully execute.
-
Single "'" inserted into SQL query leads to invalid SQL query execution, triggering full path disclosure. Possibly resultant from more general SQL injection issue.
-
chain: product does not protect against direct request of a library file, leading to resultant path disclosure when the file does not successfully execute.
-
invalid parameter triggers a failure to find an include file, leading to infoleak in error message.
-
Various invalid requests lead to information leak in verbose error messages describing the failure to instantiate a class, open a configuration file, or execute an undefined function.
-
Improper handling of filename request with trailing "/" causes multiple consequences, including information leak in Visual Basic error message.
Comment les attaquants l'exploitent
Parcours de l'attaquant étape par étape
- 1
The following servlet code does not catch runtime exceptions, meaning that if such an exception were to occur, the container may display potentially dangerous information (such as a full stack trace).
- 2
In the following Java example the class InputFileRead enables an input file to be read using a FileReader object. In the constructor of this class a default input file path is set to some directory on the local file system and the method setInputFile must be called to set the name of the input file to be read in the default directory. The method readInputFile will create the FileReader object and will read the contents of the file. If the method setInputFile is not called prior to calling the method readInputFile then the File object will remain null when initializing the FileReader object. A Java RuntimeException will be raised, and an error message will be output to the user.
- 3
However, the error message output to the user contains information regarding the default directory on the local file system. This information can be exploited and may lead to unauthorized access or use of the system. Any Java RuntimeExceptions that are handled should not expose sensitive information to the user.
Exemple de code vulnérable
Vulnerable Java
The following servlet code does not catch runtime exceptions, meaning that if such an exception were to occur, the container may display potentially dangerous information (such as a full stack trace).
public void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
String username = request.getParameter("username");
```
// May cause unchecked NullPointerException.*
if (username.length() < 10) {
```
...
}
} Exemple de code sécurisé
Secure pseudo
// Validate, sanitize, or use a safe API before reaching the sink.
function handleRequest(input) {
const safe = validateAndEscape(input);
return executeWithGuards(safe);
} What changed: the unsafe sink is replaced (or the input is validated/escaped) so the same payload no longer triggers the weakness.
Liste de contrôle de prévention
How to prevent CWE-211
- System Configuration Configure the application's environment in a way that prevents errors from being generated. For example, in PHP, disable display_errors.
- Implementation / Build and Compilation Debugging information should not make its way into a production release.
- Implementation / Build and Compilation Debugging information should not make its way into a production release.
- Implementation Handle exceptions internally and do not display errors containing potentially sensitive information to a user. Create default error pages if necessary.
- Implementation The best way to prevent this weakness during implementation is to avoid any bugs that could trigger the external error message. This typically happens when the program encounters fatal errors, such as a divide-by-zero. You will not always be able to control the use of error pages, and you might not be using a language that handles exceptions.
Signaux de détection
How to detect CWE-211
Exécuter des tests de sécurité applicative dynamique (DAST) contre le point de terminaison en ligne.
Surveiller les journaux runtime pour détecter des traces d'exception inhabituelles, des entrées malformées ou des tentatives de contournement d'autorisation.
Revue de code : signaler tout nouveau code qui traite les entrées de cette surface sans utiliser les helpers du framework validés.
Plexicus détecte automatiquement CWE-211 et ouvre une PR de correction en moins de 60 secondes.
Codex Remedium analyse chaque commit, identifie cette faiblesse précise et livre une pull request prête à être relue avec le correctif. Pas de tickets. Pas de transferts.
Questions fréquentes Qu'est-ce que CWE-211 ?
Quelle est la gravité de CWE-211 ?
Quels langages ou plateformes sont affectés par CWE-211 ?
Comment puis-je prévenir CWE-211 ?
Comment Plexicus détecte et corrige CWE-211 ?
Où puis-je en savoir plus sur CWE-211 ?
Frequently asked questions
Qu'est-ce que CWE-211 ?
This vulnerability occurs when an application triggers an error message from an external component—like a database, interpreter, or operating system—and that error reveals sensitive details about the system's internal workings, configuration, or data.
Quelle est la gravité de CWE-211 ?
MITRE n'a pas publié de note de probabilité d'exploitation pour cette faiblesse. Traitez-la comme un impact moyen jusqu'à ce que votre modèle de menace prouve le contraire.
Quels langages ou plateformes sont affectés par CWE-211 ?
MITRE lists the following affected platforms: PHP.
Comment puis-je prévenir CWE-211 ?
Configure the application's environment in a way that prevents errors from being generated. For example, in PHP, disable display_errors. Debugging information should not make its way into a production release.
Comment Plexicus détecte et corrige CWE-211 ?
Le moteur SAST de Plexicus reconnaît la signature de flux de données de CWE-211 à chaque commit. Lorsqu'une correspondance est trouvée, notre agent Codex Remedium ouvre une PR de correction avec le code corrigé, les tests et un résumé d'une ligne pour le relecteur.
Où puis-je en savoir plus sur CWE-211 ?
MITRE publie la définition canonique à https://cwe.mitre.org/data/definitions/211.html. Vous pouvez également consulter la documentation OWASP et NIST pour des conseils adjacents.
Faiblesses associées
Weaknesses related to CWE-211
CWE-209 Parent
Generation of Error Message Containing Sensitive Information
This vulnerability occurs when an application reveals sensitive details about its internal systems, user data, or environment within error…
CWE-210 Frère
Self-generated Error Message Containing Sensitive Information
This vulnerability occurs when an application detects a problem and generates its own error messages that accidentally expose sensitive…
CWE-550 Frère
Server-generated Error Message Containing Sensitive Information
This vulnerability occurs when a web application or server returns detailed error messages that reveal sensitive internal information…
CWE-535 Enfant
Exposure of Information Through Shell Error Message
This vulnerability occurs when a web application's command shell returns detailed error messages to users. Attackers can analyze these…
CWE-536 Enfant
Servlet Runtime Error Message Containing Sensitive Information
This vulnerability occurs when a Java servlet application displays detailed runtime error messages that reveal sensitive information about…
CWE-537 Enfant
Java Runtime Error Message Containing Sensitive Information
This vulnerability occurs when a Java application's runtime error messages reveal sensitive details about the system, such as file paths,…
Prêt quand vous l'êtes
Arrêtez de payer par développeur.
Commencez à fermer la boucle.
Plexicus est l'ASPM natif IA qui scanne, filtre, corrige, penteste et explique — de façon autonome. Développeurs illimités, dépôts illimités, actions IA à usage équitable. Vrai niveau gratuit, €269/mo annuel quand vous êtes prêt.