Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Comment: Edited by NavBot

Propagating the content of exceptions without performing explicit filtering is often associated with information leakage. An attacker may craft input parameters such that underlying structures and mechanisms may get exposed inadvertently. Information leakage can result from both the exception message text and the type of exception. For example, with FileNotFoundException, the message reveals the file system layout while the type conveys the absence of the file.

Wiki Markup
This guideline extends equally to both server applications as well as clients. Adversaries can glean sensitive information from not only vulnerable web servers but also innocent users who use vulnerable web browsers. In 2004, Schoenefeld  \[[Schoenefeld 04|AA. Java References#Schoenefeld 04]\] discovered an instance in the Opera v7.54 web browser, wherein an attacker could use the {{sun.security.krb5.Credentials}} class in an applet as an oracle to "retrieve the name of the currently logged in user and parse his home directory from the information which is provided by the thrown java.security.AccessControlException."

Noncompliant Code Example

This example demonstrates code that accepts a file name as an input argument on which operations are to be performed. An attacker can gain insights on the underlying file system structure by repeatedly passing different paths to fictitious files. When a file is not found, the FileInputStream constructor throws a FileNotFoundException. Other risks such as revelation of the user's home directory and as a result the user name also manifest themselves.

This example also violates the condition that user supplied input must never occur in file names or as constituting elements of file paths. This can lead to a brute force attack allowing the attacker to enumerate valid file names on a system by constantly monitoring the inputs that generate a system defined sanitized message.

Code Block
bgColor#FFcccc
import java.io.FileInputStream;
import java.io.FileNotFoundException;

class ExceptionExample {
  public static void main(String[] args) throws FileNotFoundException {
    FileInputStream fis = new FileInputStream("c:\\" + args[0]);
  }
}

Compliant Solution

To overcome the problem, the exception must be caught while taking special care to sanitize the message before propagating it to the caller. In cases where the exception type itself can reveal too much, consider throwing a different exception altogether (with a different message, or possibly a higher level exception, referred to as exception translation). The MyExceptionReporter class described in EXC05-J. Use a class dedicated to reporting exceptions is a good choice, as exemplified in this compliant solution.

Notice how Throwable is caught instead of specific exceptions. This is a departure from commonly suggested best practices, but is critical in cases where runtime exceptions or errors can reveal sensitive information. Moreover, this solution overcomes the issue of the brute force attack described earlier by accepting a denumerable set of file name choices with the aid of a switch-case clause. The actual file names and paths are as a result shielded from the user of the application.

Code Block
bgColor#ccccff
class ExceptionExample {
  public static void main(String[] args) {
    try {
      FileInputStream fis=null;
      switch(Integer.valueOf(args[0])) {
        case 1: fis = new FileInputStream("c:\\somefolder\\file1"); break;
        case 2: fis = new FileInputStream("c:\\somefolder\\file2"); break;
        //...
        default: System.out.println("Invalid option"); break;
      }      
    }
    catch(Throwable t) { 
      MyExceptionReporter.report(t); // sanitize 
    } 
  }
}

While following this guideline, make sure that security exceptions such as java.security.AccessControlException and java.lang.SecurityException are not swallowed or masked in the process. This can lead to far more pernicious effects such as missed security event log entries. The MyExceptionReporter class prescribes a method to deal with this condition.

Risk Assessment

Exceptions may inadvertently reveal sensitive information unless care is taken to limit the information displayed as the result of an exception.

Rule

Severity

Likelihood

Remediation Cost

Priority

Level

EXC01- J

medium

probable

high

P4

L3

Automated Detection

TODO

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

References

Wiki Markup
\[[SCG 07|AA. Java References#SCG 07]\] Guideline 3-4 Purge sensitive information from exceptions
\[[Gong 03|AA. Java References#Gong 03]\] 9.1 Security Exceptions
\[[MITRE 09|AA. Java References#MITRE 09]\] [CWE ID 209|http://cwe.mitre.org/data/definitions/209.html] "Error Message Information Leak", [CWE ID 600|http://cwe.mitre.org/data/definitions/600.html] "Failure to Catch All Exceptions (Missing Catch Block)", [CWE ID 497|http://cwe.mitre.org/data/definitions/497.html] "Information Leak of System Data"


EXC00-J. Do not suppress or ignore checked exceptions      11. Exceptional Behavior (EXC)      EXC02-J. Prevent exceptions while logging data