Page History

...

This guideline extends equally to both server side applications as well as clients. Adversaries can glean sensitive information from not only vulnerable web servers but also from innocent users who use vulnerable web browsers. In 2004, Schoenefeld discovered an instance in the Opera v7.54 web browser, wherein an attacker could use the {{sun.security.krb5.Credentials}} class in an applet as an oracle to "retrieve the name of the currently logged in user and parse his home directory from the information which is provided by the thrown {{java.security.AccessControlException}}." \[[Schoenefeld 04|AA. Java References#Schoenefeld 04]\].

Noncompliant Code Example

This noncompliant code example accepts a file name as an input argument. An attacker can gain insights into the structure of the underlying file system by repeatedly passing different paths to fictitious files. When a file is not found, the FileInputStream constructor throws a FileNotFoundException. It is also possible for the user's home directory and as a result the user name, to get exposed.

...

class ExceptionExample {
  public static void main(String[] args) throws FileNotFoundException {
    // Linux stores a user's home directory path in the environment variable 
    // $HOME, Windows in %APPDATA%
    FileInputStream fis = new FileInputStream(System.getenv("HOME") + args[0]);  
  }
}

Noncompliant Code Example

This noncompliant code example logs the exception and re-throws it without performing adequate message sanitization.

try {
  FileInputStream fis = new FileInputStream(System.getenv("APPDATA") + args[0]);
} catch (FileNotFoundException e) {
  // Log the exception
  throw e;
}

Compliant Solution

To overcome the problem, the exception must be caught while taking special care to sanitize the message before propagating it to the caller. In cases where the exception type itself can reveal too much information, consider throwing a different exception altogether (with a different message, or possibly a higher level exception, referred to as exception translation). The MyExceptionReporter class described in EXC01-J. Use a class dedicated to reporting exceptions is a good choice, as this compliant solution exemplifies.

...

While following this guideline, make sure that security exceptions such as java.security.AccessControlException and java.lang.SecurityException are not swallowed or masked in the process. This can lead to far more pernicious effects such as missed security event log entries (see EXC03-J. Use a logging API to log critical security exceptions). The MyExceptionReporter class prescribes a logging method to deal with this condition.

Risk Assessment

Exceptions may inadvertently reveal sensitive information unless care is taken to limit the information disclosure.

Automated Detection

TODO

Related Vulnerabilities

CVE-2009-2897

Other Languages

This rule appears in the C++ Secure Coding Standard as ERR12-CPP. Do not allow exceptions to transmit sensitive information.

References

\[[SCG 07|AA. Java References#SCG 07]\] Guideline 3-4 Purge sensitive information from exceptions
\[[Gong 03|AA. Java References#Gong 03]\] 9.1 Security Exceptions
\[[MITRE 09|AA. Java References#MITRE 09]\] [CWE ID 209|http://cwe.mitre.org/data/definitions/209.html] "Error Message Information Leak", [CWE ID 600|http://cwe.mitre.org/data/definitions/600.html] "Failure to Catch All Exceptions (Missing Catch Block)", [CWE ID 497|http://cwe.mitre.org/data/definitions/497.html] "Information Leak of System Data"

...