...
This rule applies to server-side applications as well as to clients. Attackers can glean sensitive information not only from vulnerable web servers but also from victims who use vulnerable web browsers. In 2004, Schönefeld discovered an exploit for the Opera v7.54 web browser in which an attacker could use the sun.security.krb5.Credentials class in an applet as an oracle to "retrieve the name of the currently logged in user and parse his home directory from the information which is provided by the thrown java.security.AccessControlException" [Schönefeld 2004].
All exceptions reveal information that can assist an attacker's efforts to carry out a denial of service (DoS) against the system. Consequently, programs must filter both exception messages and exception types that can propagate across trust boundaries. The following table lists several problematic exceptions:
...
C++ Secure Coding Standard | ERR12-CPP. Do not allow exceptions to transmit sensitive information |
CWE-209. Information exposure through an error message | |
| CWE-600. Uncaught exception in servlet |
| CWE-497. Exposure of system data to an unauthorized control sphere |
Bibliography
9.1, Security Exceptions |
...