...
| Wiki Markup |
|---|
This guideline extends equally to server side applications as well as clients. Adversaries can glean sensitive information from not only vulnerable web servers but also from innocent users who use vulnerable web browsers. In 2004, Schoenefeld discovered an instance in the Opera v7.54 web browser, wherein an attacker could use the {{sun.security.krb5.Credentials}} class in an applet as an oracle to "retrieve the name of the currently logged in user and parse his home directory from the information which is provided by the thrown {{java.security.AccessControlException}}." \[[Schoenefeld 2004|AA. Bibliography#Schoenefeld 04]\]. |
...
Exception Name | Description of information leak or threat |
|---|---|
| Underlying file system structure, user name enumeration |
| Database structure, user name enumeration |
| Enumeration of open ports when untrusted client can choose server port |
| May provide information about thread-unsafe code |
| Insufficient server resources (may aid DoS) |
| Resource enumeration |
| Underlying file system structure |
| Owner enumeration |
| Denial of service (DoS) |
| Denial of service (DoS) |
Noncompliant Code Example (
...
Leaks from
...
Exception Message and
...
Type)
This noncompliant code example accepts a file name as an input argument. An attacker can gain insights into the structure of the underlying file system by repeatedly passing different paths to fictitious files. When a file is not found, the FileInputStream constructor throws a FileNotFoundException.
...
| Code Block | ||
|---|---|---|
| ||
try {
FileInputStream fis = new FileInputStream(System.getenv("APPDATA") + args[0]);
} catch (FileNotFoundException e) {
// Log the exception
throw e;
}
|
Noncompliant Code Example (
...
Wrapping and Rethrowing Sensitive Exception)
This noncompliant code example logs the exception and wraps it in an unchecked exception before re-throwing it.
| Code Block | ||
|---|---|---|
| ||
try {
FileInputStream fis = new FileInputStream(System.getenv("APPDATA") + args[0]);
} catch (FileNotFoundException e) {
// Log the exception
throw new RuntimeException("Unable to retrieve file", e);
}
|
Compliant Solution (
...
Forward to
...
Dedicated Handler or
...
Reporter)
The exception must be caught while taking special care to sanitize the message before propagating it to the caller. In cases where the exception type itself can reveal too much information, consider throwing a different exception altogether (with a different message, or possibly a higher level exception, referred to as exception translation). The MyExceptionReporter class described in guideline EXC01-J. Use a class dedicated to reporting exceptions is a good choice, as this compliant solution exemplifies.
...
While following this guideline, make sure that security exceptions such as java.security.AccessControlException and java.lang.SecurityException are not masked in the process. This can lead to far more pernicious effects such as missed security event log entries. (see See guideline EXC03-J. Use a logging API to log critical security exceptions.) . The MyExceptionReporter class prescribes a logging method to deal with this condition.
...
Exceptions may inadvertently reveal sensitive information unless care is taken to limit the information disclosure.
Rule Guideline | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
EXC06-J | medium | probable | high | P4 | L3 |
...