CWE-211: Externally-Generated Error Message Containing Sensitive Information

Description:
The product performs an operation that triggers an external diagnostic or error message that is not directly generated or controlled by the product, such as an error generated by the programming language interpreter that a software application uses. The error can contain sensitive system information.

Affected languages: PHP, Not Language-Specific
Affected technologies: Not Technology-Specific
Parent weaknesses: CWE-209

Consequences:
  - Confidentiality: Read Application Data

Mitigations:
  - [System Configuration] Configure the application's environment in a way that prevents errors from being generated. For example, in PHP, disable display_errors.
  - [Implementation] Debugging information should not make its way into a production release.
  - [Implementation] Debugging information should not make its way into a production release.
  - [Implementation] Handle exceptions internally and do not display errors containing potentially sensitive information to a user. Create default error pages if necessary.

Demonstrative examples:
The following servlet code does not catch runtime exceptions, meaning that if such an exception were to occur, the container may display potentially dangerous information (such as a full stack trace).

public void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { 
                         String username = request.getParameter("username"); 
                            
                            // May cause unchecked NullPointerException. 
                            if (username.length() < 10) { ... } 
                      }

In the following Java example the class InputFileRead enables an input file to be read using a FileReader object. In the constructor of this class a default input file path is set to some directory on the local file system and the method setInputFile must be called to set the name of the input file to be read in the default directory. The method readInputFile will create the FileReader object and will read the contents of the file. If the method setInputFile is not called prior to calling the method readInputFile then the File object will remain null when initializing the FileReader object. A Java RuntimeException will be raised, and an error message will be output to the user.
However, the error message output to the user contains information regarding the default directory on the local f

Real-world examples:
  - CVE-2004-1581: chain: product does not protect against direct request of an include file, leading to resultant path disclosure when the include file does not successfully execute.
  - CVE-2004-1579: Single "'" inserted into SQL query leads to invalid SQL query execution, triggering full path disclosure. Possibly resultant from more general SQL injection issue.
  - CVE-2005-0459: chain: product does not protect against direct request of a library file, leading to resultant path disclosure when the file does not successfully execute.
  - CVE-2005-0443: invalid parameter triggers a failure to find an include file, leading to infoleak in error message.
  - CVE-2005-0433: Various invalid requests lead to information leak in verbose error messages describing the failure to instantiate a class, open a configuration file, or execute an undefined function.