Generation of Error Message Containing Sensitive Information (CWE-209)

Generation of Error Message Containing Sensitive Information

The product generates an error message that includes sensitive information about its environment, users, or associated data.

The sensitive information may be valuable information on its own, or it may be useful for launching other, more serious attacks. The error message may be created in different ways, and the information that is included can range widely.

보급률

보통

3개 언어 지원

영향

보통

검토 권장

예방

문서화됨

5개의 수정 예시

2 예방

이 취약점을 수정하는 방법

5개의 Shoulder 탐지 규칙을 기반으로 한 Error Message Information Leak 예방 전략.

🐹 Go 모두 보기 Go 자세히 →

Database Error Information Exposure in HTTP Response MEDIUM

Return generic error messages to clients; log detailed errors server-side

+2 -1 go

  func handler(w http.ResponseWriter, r *http.Request) {
      rows, err := db.Query("SELECT * FROM users")
      if err != nil {
-         http.Error(w, err.Error(), 500)
+         log.Printf("database query failed: %v", err)
+         http.Error(w, "Internal server error", 500)
          return
      }
  }

🟨 JavaScript 모두 보기 JavaScript 자세히 →

Information Exposure Through Error Messages MEDIUM

Return generic error messages to users and log detailed errors server-side

+2 -1 javascript

  } catch (error) {
-   res.status(500).json({ error: error.message, stack: error.stack });
+   logger.error('Operation failed', { error: error.message });
+   res.status(500).json({ error: 'An error occurred' });
  }

tRPC Error Information Disclosure MEDIUM

Configure errorFormatter to strip stack traces in production and use TRPCError with generic messages

+26 -14 javascript

- import { initTRPC } from '@trpc/server';
- import { router, publicProcedure } from './trpc';
- 
- export const t = initTRPC.context<Context>().create({
-   // No errorFormatter configured
- });
- 
- export const userRouter = router({
-   createUser: publicProcedure
-     .mutation(async ({ input }) => {
-       try {
-         return await db.user.create({ data: input });
-       } catch (err) {
-         throw err; // Raw database error exposed to client
+ import { initTRPC, TRPCError } from '@trpc/server';
+ 
+ export const t = initTRPC.context<Context>().create({
+   errorFormatter({ shape }) {
+     return {
+       ...shape,
+       data: {
+         ...shape.data,
+         stack: process.env.NODE_ENV === 'production'
+           ? undefined
+           : shape.data.stack,
+       },
+     };
+   },
+ });
+ 
+ export const userRouter = router({
+   createUser: publicProcedure
+     .mutation(async ({ input }) => {
+       try {
+         return await db.user.create({ data: input });
+       } catch (err) {
+         throw new TRPCError({
+           code: 'INTERNAL_SERVER_ERROR',
+           message: 'Failed to create user',
+         });
        }
      })
  });

🐍 Python 모두 보기 Python 자세히 →

Error Message Information Disclosure MEDIUM

Log full exception details internally but return generic error messages to users

+13 -9 python

- from flask import jsonify
- 
- @app.route('/api/process')
- def process():
-     try:
-         result = expensive_operation()
-         return jsonify(result)
-     except Exception as e:
-         return jsonify({'error': str(e)}), 500
+ import logging
+ from flask import jsonify
+ 
+ logger = logging.getLogger(__name__)
+ 
+ @app.route('/api/process')
+ def process():
+     try:
+         result = expensive_operation()
+         return jsonify(result)
+     except Exception as e:
+         logger.error(f"Processing failed: {e}", exc_info=True)
+         return jsonify({'error': 'Internal server error'}), 500

Internal Path and IP Address Disclosure MEDIUM

Return generic responses; log internal paths server-side only

+9 -9 python

- from flask import jsonify
- 
- @app.route('/info')
- def get_info():
-     return jsonify({
-         'status': 'ok',
-         'path': __file__,
-         'cwd': os.getcwd()
-     })
+ import logging
+ from flask import jsonify
+ 
+ logger = logging.getLogger(__name__)
+ 
+ @app.route('/info')
+ def get_info():
+     logger.info(f"Info request from {__file__}")
+     return jsonify({'status': 'ok', 'version': '1.0'})

3 탐지

코드에서 취약점 찾기

Shoulder를 사용하여 코드에서 Generation of Error Message Containing Sensitive Information 패턴을 스캔하세요. 5 규칙.

터미널

# Scan with Shoulder CLI
npx @shoulderdev/cli trust --cwe=209

# Or scan entire project
npx @shoulderdev/cli trust .

탐지 규칙 (5)

🟨 Javascript 2 rules

Information Exposure Through Error Messages MEDIUM

Detects exposure of sensitive error information (error.message, error.stack, raw error objects) in HTTP responses. This can leak: - Internal file paths and directory structure - Database schema and query details - Third-party API endpoints and credentials - Software versions and technology stack - Business logic and validation rules Attackers use this information to: - Map internal architecture - Identify vulnerable dependencies - Craft targeted attacks - Bypass security controls

tRPC Error Information Disclosure MEDIUM

Exposing raw errors, stack traces, or database details to clients aids attackers in reconnaissance and exploitation.

🔷 Typescript 2 rules

Information Exposure Through Error Messages MEDIUM

tRPC Error Information Disclosure MEDIUM

Exposing raw errors, stack traces, or database details to clients aids attackers in reconnaissance and exploitation.

🐍 Python 2 rules

Error Message Information Disclosure MEDIUM

Detects error messages that expose sensitive implementation details like stack traces, database errors, file paths, or internal system information. This information can help attackers understand the system architecture.

Internal Path and IP Address Disclosure MEDIUM

Detects responses that include internal file paths, IP addresses, or system information. This information helps attackers understand the system architecture, file structure, and internal network topology.

🐹 Go 1 rules

Database Error Information Exposure in HTTP Response MEDIUM

Internal error messages or stack traces exposed to users in HTTP responses.

4 경고 신호

코드 리뷰에서 주의할 점

이 패턴은 잠재적인 Generation of Error Message Containing Sensitive Information 취약점을 나타냅니다. 코드 리뷰와 보안 감사 중에 찾아보세요.

🟡

exposure of sensitive error information (error javascript-error-message-exposure

🟡

error messages that expose sensitive implementation details like stack traces, database errors, file python-error-message-exposure

🟡

responses that include internal file paths, IP addresses, or system information python-internal-path-disclosure

🟡

Error handling exposes implementation details. Use error formatter to sanitize errors in production. trpc-error-information-leak

🔍

코드베이스를 스캔하세요: Generation of Error Message Containing Sensitive Information

Shoulder CLI는 전체 코드베이스에서 취약한 패턴을 찾아냅니다.

npx shoulder trust 모든 규칙 보기