The product identifies an error condition and creates its own diagnostic or error messages that contain sensitive information.
N/A
Threat Mapped score: 3.0
Industry: Finiancial
Threat priority: P2 - Serious (High)
CVE: CVE-2005-1745
Infoleak of sensitive information in error message (physical access required).
N/A
N/A
| Phase | Note |
|---|---|
| Architecture and Design | N/A |
| Implementation | REALIZATION: This weakness is caused during implementation of an architectural security tactic. |
Intro: The following code uses custom configuration files for each user in the application. It checks to see if the file exists on the system before attempting to open and use the file. If the configuration file does not exist, then an error is generated, and the application exits.
Body: If this code is running on a server, such as a web application, then the person making the request should not know what the full pathname of the configuration directory is. By submitting a username that is not associated with a configuration file, an attacker could get this pathname from the error message. It could then be used to exploit path traversal, symbolic link following, or other problems that may exist elsewhere in the application.
$uname = GetUserInput("username"); # avoid CWE-22, CWE-78, others. if ($uname !~ /^\w+$/) { ExitError("Bad hacker!") ; } $filename = "/home/myprog/config/" . $uname . ".txt"; if (!(-e $filename)) { ExitError("Error: $filename does not exist"); }