Back to Vulnerability Database

Exposure of Sensitive Information to an Unauthorized Actor

Description

Exposure of Sensitive Information to an Unauthorized Actor occurs when a product intentionally or unintentionally discloses sensitive information to parties who should not have access to it. This encompasses a wide range of scenarios including verbose error messages revealing system internals, debug information left in production, improper access controls on data stores, information leaked through side channels, and sensitive data included in logs or responses. The exposed information can range from technical details enabling further attacks to personal data causing privacy violations.

Risk

Information exposure is a fundamental security weakness that often serves as a precursor to more severe attacks. Exposed system configuration, database schemas, or API structures enable attackers to craft targeted exploits. Leaked credentials provide direct unauthorized access. Personal information exposure leads to identity theft, financial fraud, and regulatory compliance violations. The 2017 Equifax breach exposed 147 million individuals' sensitive data including Social Security numbers. Organizations face substantial reputational damage, legal liability, and regulatory fines (GDPR, HIPAA, PCI-DSS) when sensitive information is exposed.

Solution

Implement principle of least privilege for all data access. Use generic error messages in production that do not reveal internal details. Sanitize all output to remove sensitive information before transmission. Apply proper access controls to data stores, logs, and configuration files. Implement data classification and handle each class appropriately. Remove or disable debug features in production. Conduct regular security audits and penetration testing. Use automated tools to detect information exposure vulnerabilities. Train developers on secure coding practices for handling sensitive data.

Common Consequences

ImpactDetails
ConfidentialityScope: Information Disclosure

Direct exposure of sensitive data including credentials, personal information, financial data, or health records.
Access ControlScope: Attack Surface Expansion

Exposed technical details about system architecture, database schemas, or software versions enable targeted attacks.
IntegrityScope: Follow-on Attacks

Leaked information facilitates SQL injection, authentication bypass, and other attacks that compromise system integrity.

Example Code + Solution Code

Vulnerable Code

# VULNERABLE: Detailed error message exposes internals
def get_user(user_id):
    try:
        query = f"SELECT * FROM users WHERE id = {user_id}"
        result = db.execute(query)
        return result
    except Exception as e:
        # Exposes database structure and query
        return {"error": f"Database error: {str(e)}, Query: {query}"}

# VULNERABLE: Debug information in production
@app.route('/api/user/<id>')
def get_user_api(id):
    user = User.query.get(id)
    return {
        "user": user.to_dict(),
        "debug": {
            "query_time": db.last_query_time,
            "db_host": db.host,          # Exposes infrastructure
            "stack_trace": traceback.format_stack()  # Exposes internals
        }
    }

# VULNERABLE: Sensitive data in logs
def process_payment(card_number, cvv, amount):
    logger.info(f"Processing payment: card={card_number}, cvv={cvv}")  # PCI violation!
    # ...

// VULNERABLE: Stack trace in response
@RestController
public class UserController {
    @GetMapping("/user/{id}")
    public ResponseEntity<?> getUser(@PathVariable Long id) {
        try {
            return ResponseEntity.ok(userService.findById(id));
        } catch (Exception e) {
            // Exposes full stack trace to client
            return ResponseEntity.status(500)
                .body("Error: " + e.toString() + "\n" + Arrays.toString(e.getStackTrace()));
        }
    }
}

Fixed Code

import logging

# SAFE: Generic error messages
def get_user_safe(user_id):
    try:
        # Use parameterized queries (also prevents SQL injection)
        query = "SELECT * FROM users WHERE id = %s"
        result = db.execute(query, (user_id,))
        return result
    except Exception as e:
        # Log detailed error internally
        logging.error(f"Database error for user {user_id}: {str(e)}")
        # Return generic message to user
        return {"error": "Unable to retrieve user. Please try again later."}

# SAFE: No debug information in production
@app.route('/api/user/<id>')
def get_user_api_safe(id):
    user = User.query.get(id)
    if not user:
        return {"error": "User not found"}, 404

    # Return only necessary data
    return {
        "id": user.id,
        "name": user.name,
        "email": user.email  # Only if authorized
    }

# SAFE: Mask sensitive data in logs
def process_payment_safe(card_number, cvv, amount):
    masked_card = f"****{card_number[-4:]}"
    logging.info(f"Processing payment: card={masked_card}, amount={amount}")
    # CVV never logged
    # ...

// SAFE: Structured error handling
@RestController
public class UserController {
    private static final Logger logger = LoggerFactory.getLogger(UserController.class);

    @GetMapping("/user/{id}")
    public ResponseEntity<?> getUser(@PathVariable Long id) {
        try {
            return ResponseEntity.ok(userService.findById(id));
        } catch (UserNotFoundException e) {
            return ResponseEntity.status(404)
                .body(Map.of("error", "User not found"));
        } catch (Exception e) {
            // Log detailed error internally
            logger.error("Error retrieving user {}: {}", id, e.getMessage(), e);
            // Return generic message
            return ResponseEntity.status(500)
                .body(Map.of("error", "An unexpected error occurred"));
        }
    }
}

Exploited in the Wild

Equifax Data Breach (Equifax, 2017)

The Equifax breach exposed sensitive data of 147 million individuals including Social Security numbers, birth dates, and credit card details. The initial vulnerability (Apache Struts CVE-2017-5638) led to extensive data exposure due to inadequate data protection controls.

Facebook Cambridge Analytica (Facebook, 2018)

Improper exposure of user data through Facebook's API allowed Cambridge Analytica to harvest personal information of 87 million users, leading to massive regulatory fines and reputational damage.

Capital One Data Breach (Capital One, 2019)

Misconfigured WAF rules exposed sensitive information including 100 million credit applications, Social Security numbers, and bank account numbers through a server-side request forgery attack.

Tools to test/exploit

  • Burp Suite — intercept and analyze responses for information disclosure.

  • OWASP ZAP — automated scanner for information exposure vulnerabilities.

  • Nikto — web server scanner that identifies information leakage.

CVE Examples

References

  1. MITRE. "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor." https://cwe.mitre.org/data/definitions/200.html

  2. OWASP. "Sensitive Data Exposure." https://owasp.org/www-project-web-security-testing-guide/

  3. CWE Top 25. "2024 CWE Top 25 Most Dangerous Software Weaknesses." https://cwe.mitre.org/top25/