Generation of Error Message Containing Sensitive Information

Opis

The product generates an error message that includes sensitive information about its environment, users, or associated data.

Skutki

• Confidentiality

  Read Application Data

  Often this will either reveal sensitive information which may be used to launch another, more focused attack or disclose private information stored in the server. For example, an attempt to exploit a path traversal weakness (CWE-22) might yield the full pathname of the installed application. In turn, this could be used to select the proper number of ".." sequences to navigate to the targeted file. An attack using SQL injection (CWE-89) might not initially succeed, but an error message could reveal the malformed query, which would expose query logic and possibly even passwords or other sensitive information used within the query.

Zapobieganie

• Implementation

  Ensure that error messages only contain minimal details that are useful to the intended audience and no one else. The messages need to strike the balance between being too cryptic (which can confuse users) or being too detailed (which may reveal more than intended). The messages should not reveal the methods that were used to determine the error. Attackers can use detailed information to refine or optimize their original attack, thereby increasing their chances of success.

  If errors must be captured in some detail, record them in log messages, but consider what could occur if the log messages can be viewed by attackers. Highly sensitive information such as passwords should never be saved to log files.

  Avoid inconsistent messaging that might accidentally tip off an attacker about internal state, such as whether a user account exists or not.

• Implementation

  Handle exceptions internally and do not display errors containing potentially sensitive information to a user.

• Implementation · Attack Surface Reduction

  Use naming conventions and strong types to make it easier to spot when sensitive data is being used. When creating structures, objects, or other complex entities, separate the sensitive and non-sensitive data as much as possible.

  Skuteczność: Defense in Depth

• Implementation, Build and Compilation · Compilation or Build Hardening

  Debugging information should not make its way into a production release.

• Implementation, Build and Compilation · Environment Hardening

  Debugging information should not make its way into a production release.

• System Configuration

  Where available, configure the environment to use less verbose error messages. For example, in PHP, disable the display_errors setting during configuration, or at runtime using the error_reporting() function.

• System Configuration

  Create default error pages or messages that do not leak any information.

Przykłady podatności

• CVE-2008-2049 POP3 server reveals a password in an error message after multiple APOP commands are sent. Might be resultant from another weakness.
• CVE-2007-5172 Program reveals password in error message if attacker can trigger certain database errors.
• CVE-2008-4638 Composite: application running with high privileges (CWE-250) allows user to specify a restricted file to process, which generates a parsing error that leaks the contents of the file (CWE-209).
• CVE-2008-1579 Existence of user names can be determined by requesting a nonexistent blog and reading the error message.
• CVE-2007-1409 Direct request to library file in web application triggers pathname leak in error message.
• CVE-2008-3060 Malformed input to login page causes leak of full path when IMAP call fails.
• CVE-2005-0603 Malformed regexp syntax leads to information exposure in error message.
• CVE-2017-9615 verbose logging stores admin credentials in a world-readablelog file
• CVE-2018-1999036 SSH password for private key stored in build log

Słabość nadrzędna

• CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
• CWE-755 Improper Handling of Exceptional Conditions

Słabości podrzędne

• CWE-210 Self-generated Error Message Containing Sensitive Information
• CWE-211 Externally-Generated Error Message Containing Sensitive Information
• CWE-550 Server-generated Error Message Containing Sensitive Information

Kiedy powstaje

• Architecture and Design
• Implementation — REALIZATION: This weakness is caused during implementation of an architectural security tactic.
• System Configuration
• Operation

Dotyczy

PHP, Java, Not Language-Specific, Not Technology-Specific

Uwagi

The sensitive information may be valuable information on its own (such as a password), or it may be useful for launching other, more serious attacks.

The error message may be created in different ways:

- self-generated: the source code explicitly constructs the error message and delivers it

- externally-generated: the external environment, such as a language interpreter, handles the error and constructs its own message, whose contents are not under direct control by the programmer

Źródła

1. Information Leakage — Web Application Security Consortium
2. Secure Programming with Static Analysis — Brian Chess, Jacob West, Section 9.2, Page 326, Addison-Wesley, 2007
3. Writing Secure Code — Michael Howard, David LeBlanc, Chapter 16, "General Good Practices." Page 415, Microsoft Press, 2001
4. 24 Deadly Sins of Software Security — Michael Howard, David LeBlanc, John Viega, "Sin 11: Failure to Handle Errors Correctly." Page 183, McGraw-Hill, 2010
5. 24 Deadly Sins of Software Security — Michael Howard, David LeBlanc, John Viega, "Sin 12: Information Leakage." Page 191, McGraw-Hill, 2010
6. Top 25 Series - Rank 16 - Information Exposure Through an Error Message — Johannes Ullrich, SANS Software Security Institute, 2010
7. The Art of Software Security Assessment — Mark Dowd, John McDonald, Justin Schuh, Chapter 3, "Overly Verbose Error Messages", Page 75, Addison Wesley, 2006
8. The CLASP Application Security Process — Secure Software, Inc., 2005