...
Exception Name | Description of information leak or threat |
|---|---|
| Underlying file system structure, user name enumeration |
| Database structure, user name enumeration |
| Enumeration of open ports when untrusted client can choose server port |
| May provide information about thread-unsafe code |
| Insufficient server resources (may aid DoS) |
| Resource enumeration |
| Underlying file system structure |
| Owner enumeration |
| Denial of service (DoS) |
| Denial of service (DoS) |
Noncompliant Code Example (Leaks from Exception Message and Type)
This noncompliant code example accepts a file name as an input argument. An attacker can learn about the structure of the underlying file system by repeatedly passing constructed paths to fictitious files. When a requested file is absent, the FileInputStream constructor throws a FileNotFoundException.
...
This noncompliant example fails to sanitize the exception, consequently enabling the attacker to learn the user's home directory and user name.
Noncompliant Code Example (rethrowing sensitive exception)
This noncompliant code example logs the exception and re-throws it without performing adequate message sanitization.
| Code Block | ||
|---|---|---|
| ||
try {
FileInputStream fis = new FileInputStream(System.getenv("APPDATA") + args[0]);
} catch (FileNotFoundException e) {
// Log the exception
throw e;
}
|
Noncompliant Code Example (Wrapping and Rethrowing Sensitive Exception)
This noncompliant code example logs the exception and wraps it in an unchecked exception before re-throwing it.
| Code Block | ||
|---|---|---|
| ||
try {
FileInputStream fis = new FileInputStream(System.getenv("APPDATA") + args[0]);
} catch (FileNotFoundException e) {
// Log the exception
throw new RuntimeException("Unable to retrieve file", e);
}
|
Compliant Solution (Forward to Dedicated Handler or Reporter)
This compliant solution catches and sanitizes the exception and its message before allowing the exception to propagate to the caller. In cases where the exception type itself can reveal too much information, consider throwing a different exception altogether (with a different message, or possibly a higher level exception; this is exception translation). One good solution is to use the MyExceptionReporter class described in guideline ERR01-J. Use a class dedicated to reporting exceptions, as shown in this compliant solution.
...
Compliant solutions must ensure that security exceptions such as java.security.AccessControlException and java.lang.SecurityException continue to be logged and sanitized appropriately. See guideline ERR03-J. Use a logging API to log critical security exceptions for additional information. The MyExceptionReporter class from guideline ERR01-J. Use a class dedicated to reporting exceptions demonstrates an acceptable approach for this logging and sanitization.
Risk Assessment
Exceptions may inadvertently reveal sensitive information unless care is taken to limit the information disclosure.
Guideline | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
EXC06-J | medium | probable | high | P4 | L3 |
Related Vulnerabilities
Other Languages
This guideline appears in the C++ Secure Coding Standard as ERR12-CPP. Do not allow exceptions to transmit sensitive information.
Bibliography
| Wiki Markup |
|---|
\[[Gong 2003|AA. Bibliography#Gong 03]\] 9.1 Security Exceptions \[[MITRE 2009|AA. Bibliography#MITRE 09]\] [CWE ID 209|http://cwe.mitre.org/data/definitions/209.html] "Error Message Information Leak", [CWE ID 600|http://cwe.mitre.org/data/definitions/600.html] "Failure to Catch All Exceptions (Missing Catch Block)", [CWE ID 497|http://cwe.mitre.org/data/definitions/497.html] "Information Leak of System Data" \[[SCG 2007|AA. Bibliography#SCG 07]\] Guideline 3-4 Purge sensitive information from exceptions |
...