CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Description:
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Extended Description:
There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker.  Some kinds of sensitive information include: 
        
          private, personal information, such as personal messages, financial data, health records, geographic location, or contact details 
          system status and environment, such as the operating system and installed packages 
		  business secrets and intellectual property 
		  network status and configuration 
		  the product's own code or internal state 
          metadata, e.g. logging of connections or message headers 
		  indirect information, such as a discrepancy between two internal operations that can be observed by an outsider 
        
	     Information might be sensitive to different parties, each of which may have their own expectatio

Affected languages: Not Language-Specific
Affected technologies: Not Technology-Specific, Web Based, Mobile
Parent weaknesses: CWE-668

Consequences:
  - Confidentiality: Read Application Data

Detection methods:
  - Automated Static Analysis - Binary or Bytecode: According to SOAR [REF-1479], the following detection techniques may be useful: 
                   
                      Cost effective for partial coverage: 
                         
             
  - Dynamic Analysis with Automated Results Interpretation: According to SOAR [REF-1479], the following detection techniques may be useful: 
                   
                      Highly cost effective: 
                         
                           
  - Dynamic Analysis with Manual Results Interpretation: According to SOAR [REF-1479], the following detection techniques may be useful: 
                   
                      Cost effective for partial coverage: 
                         
             
  - Manual Static Analysis - Source Code: According to SOAR [REF-1479], the following detection techniques may be useful: 
                   
                      Highly cost effective: 
                         
                           

Mitigations:
  - [Architecture and Design] Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. 
                   Ensure that appropriate compartm

Demonstrative examples:
The following code checks validity of the supplied username and password and notifies the user of a successful or failed login.
In the above code, there are different messages for when an incorrect username is supplied, versus when the username is correct but the password is wrong. This difference enables a potential attacker to understand the state of the login function, and could allow an attacker to discover a valid username by trying different values until the incorrect password message is returned. In essence, this makes it easier for an attacker to obtain half of the necessary authentication credentials.
my $username=param('username');
                   my $password=param('password');
                   
                   if (IsValidUsername($username) == 1)
                   {
  

This code tries to open a database connection, and prints any exceptions that occur.
If an exception occurs, the printed message exposes the location of the configuration file the script is using. An attacker can use this information to target the configuration file (perhaps exploiting a Path Traversal weakness). If the file can be read, the attacker could gain credentials for accessing the database. The attacker may also be able to replace the file with a malicious one, causing the application to use an arbitrary database.
try { openDbConnection(); } 
                      //print exception message that includes exception message and configuration file location 
                      catch (Exception $e) { echo 'Caught exception: ', $e->getMessage(), '\n'; echo 'Check credentials in confi

Real-world examples:
  - CVE-2022-31162: Rust library leaks Oauth client details in application debug logs
  - CVE-2021-25476: Digital Rights Management (DRM) capability for mobile platform leaks pointer information, simplifying ASLR bypass
  - CVE-2001-1483: Enumeration of valid usernames based on inconsistent responses
  - CVE-2001-1528: Account number enumeration via inconsistent responses.
  - CVE-2004-2150: User enumeration via discrepancies in error messages.