CWE-210 通过自主产生的错误消息导致的信息暴露

Information Exposure Through Self-generated Error Message

结构: Simple

Abstraction: Base

状态: Draft

被利用可能性: unkown

基本描述

The software identifies an error condition and creates its own diagnostic or error messages that contain sensitive information.

相关缺陷

  • cwe_Nature: ChildOf cwe_CWE_ID: 209 cwe_View_ID: 1000 cwe_Ordinal: Primary

  • cwe_Nature: ChildOf cwe_CWE_ID: 209 cwe_View_ID: 699 cwe_Ordinal: Primary

适用平台

Language: {'cwe_Class': 'Language-Independent', 'cwe_Prevalence': 'Undetermined'}

常见的影响

范围 影响 注释
Confidentiality Read Application Data

可能的缓解方案

MIT-40 ['Implementation', 'Build and Compilation']

策略: Compilation or Build Hardening

Debugging information should not make its way into a production release.

MIT-40 ['Implementation', 'Build and Compilation']

策略: Environment Hardening

Debugging information should not make its way into a production release.

示例代码

例

The following code uses custom configuration files for each user in the application. It checks to see if the file exists on the system before attempting to open and use the file. If the configuration file does not exist, then an error is generated, and the application exits.

bad Perl

$uname = GetUserInput("username");


# avoid CWE-22, CWE-78, others.
if ($uname !~ /^\w+$/)
{
ExitError("Bad hacker!") ;
}

$filename = "/home/myprog/config/" . $uname . ".txt";
if (!(-e $filename))
{
ExitError("Error: $filename does not exist");
}

If this code is running on a server, such as a web application, then the person making the request should not know what the full pathname of the configuration directory is. By submitting a username that is not associated with a configuration file, an attacker could get this pathname from the error message. It could then be used to exploit path traversal, symbolic link following, or other problems that may exist elsewhere in the application.

分析过的案例

标识 说明 链接

分类映射

映射的分类名 ImNode ID Fit Mapped Node Name
PLOVER Product-Generated Error Message Infoleak
Software Fault Patterns SFP23 Exposed Data

引用