Generation of Error Message Containing Sensitive Information

Description

Generation of Error Message Containing Sensitive Information occurs when an application creates error messages that contain details helpful to attackers, such as database structures, file paths, software versions, configuration settings, or even credentials. These messages can be self-generated (explicitly constructed in source code) or externally-generated (produced by frameworks, interpreters, or databases). While verbose error messages aid debugging, they provide attackers with reconnaissance data that facilitates targeted attacks.

Risk

Verbose error messages are a primary source of information for attackers during reconnaissance. Stack traces reveal application structure, libraries, and execution flow. Database errors expose table names, column names, and query logic—enabling SQL injection refinement. Path disclosure enables path traversal attacks by revealing directory structures. Version information helps attackers identify known vulnerabilities. In production environments, such information exposure is a significant security gap. This vulnerability is classified under OWASP Top 10's "Insecure Design" category due to the fundamental design flaw of exposing internal details.

Solution

Implement custom error handling that provides generic messages to users while logging detailed errors securely for administrators. Configure production environments to disable debug mode and verbose error reporting. Create error pages that don't reveal stack traces, database queries, or system paths. Centralize exception handling to ensure consistent error responses. For frameworks, configure production error handlers appropriately (e.g., DEBUG=False in Django, custom error pages in ASP.NET). Review and sanitize all error output before deployment.

Common Consequences

Impact	Details
Confidentiality	Scope: Information Disclosure Error messages expose sensitive data including credentials, internal paths, database schemas, and configuration details.
Access Control	Scope: Attack Facilitation Exposed information enables attackers to craft targeted attacks like SQL injection, path traversal, or authentication bypass.
Security	Scope: Reconnaissance Version information and stack traces reveal software and library versions with known vulnerabilities.

Example Code + Solution Code

Vulnerable Code

// VULNERABLE: Full stack trace in response
@RestController
public class DatabaseController {
    @GetMapping("/data")
    public ResponseEntity<?> getData(@RequestParam String query) {
        try {
            return ResponseEntity.ok(jdbcTemplate.queryForList(query));
        } catch (SQLException e) {
            // Exposes database error, query structure, and stack trace
            return ResponseEntity.status(500)
                .body("Database Error: " + e.getMessage() +
                      "\nQuery: " + query +
                      "\nStack Trace: " + Arrays.toString(e.getStackTrace()));
        }
    }
}

// VULNERABLE: PHP error exposes path and configuration
<?php
// Error displays full file path and line numbers
error_reporting(E_ALL);
ini_set('display_errors', 1);

function getUser($id) {
    $conn = new mysqli("localhost", "root", "password123", "users");
    // SQLException exposes database credentials and structure
    $result = $conn->query("SELECT * FROM users WHERE id = $id");
    return $result;
}
?>

# VULNERABLE: Django debug mode in production
# settings.py
DEBUG = True  # NEVER in production!
ALLOWED_HOSTS = ['*']

# Exposes full traceback, local variables, and SQL queries

Fixed Code

// SAFE: Generic error response with secure logging
@RestController
@ControllerAdvice
public class DatabaseController {
    private static final Logger logger = LoggerFactory.getLogger(DatabaseController.class);

    @GetMapping("/data")
    public ResponseEntity<?> getData(@RequestParam String id) {
        try {
            // Use parameterized queries
            return ResponseEntity.ok(dataService.findById(id));
        } catch (Exception e) {
            // Log detailed error internally
            String errorId = UUID.randomUUID().toString();
            logger.error("Error ID {}: Database operation failed - {}",
                        errorId, e.getMessage(), e);

            // Return generic message with reference ID
            return ResponseEntity.status(500)
                .body(Map.of(
                    "error", "An error occurred processing your request",
                    "reference", errorId
                ));
        }
    }

    @ExceptionHandler(Exception.class)
    public ResponseEntity<?> handleException(Exception e) {
        logger.error("Unhandled exception: {}", e.getMessage(), e);
        return ResponseEntity.status(500)
            .body(Map.of("error", "Internal server error"));
    }
}

// SAFE: Production error handling
<?php
// Disable error display in production
error_reporting(0);
ini_set('display_errors', 0);
ini_set('log_errors', 1);
ini_set('error_log', '/var/log/php/error.log');

function getUser($id) {
    try {
        $conn = new PDO($dsn, $user, $pass);
        $stmt = $conn->prepare("SELECT * FROM users WHERE id = ?");
        $stmt->execute([$id]);
        return $stmt->fetch();
    } catch (PDOException $e) {
        // Log internally
        error_log("Database error: " . $e->getMessage());
        // Return generic message
        throw new UserException("Unable to retrieve user information");
    }
}
?>

# SAFE: Django production settings
# settings.py
DEBUG = False
ALLOWED_HOSTS = ['mysite.com']

# Custom error views
handler404 = 'myapp.views.custom_404'
handler500 = 'myapp.views.custom_500'

LOGGING = {
    'handlers': {
        'file': {
            'class': 'logging.FileHandler',
            'filename': '/var/log/django/error.log',
        },
    },
    'loggers': {
        'django': {
            'handlers': ['file'],
            'level': 'ERROR',
        },
    },
}

---

Exploited in the Wild

GitLab Information Disclosure (GitLab, 2025)

Multiple CWE-209 vulnerabilities in GitLab CE/EE exposed sensitive information through error messages, affecting enterprise source code management systems.

• https://about.gitlab.com/releases/categories/releases/

Umbraco CMS Information Disclosure (Umbraco, 2025)

Information disclosure vulnerability in Umbraco CMS allowed attackers to gather system information through verbose error messages.

• https://umbraco.com/products/umbraco-cms/security-release-notes/

Nextcloud Calendar (Nextcloud, 2025)

Error message information exposure in Nextcloud Calendar disclosed internal details to unauthorized users.

• https://nextcloud.com/security/

---

Tools to test/exploit

• Burp Suite — manipulate requests to trigger error conditions.

• OWASP ZAP — spider and scan for information disclosure in errors.

• Nikto — web server scanner identifying verbose error responses.

---

CVE Examples

• CVE-2024-21733 — Apache Tomcat information exposure through error messages.

• CVE-2023-44487 — HTTP/2 implementation errors exposing system information.

• CVE-2023-2868 — Barracuda ESG error message disclosure.

---

References

1. MITRE. "CWE-209: Generation of Error Message Containing Sensitive Information." https://cwe.mitre.org/data/definitions/209.html

2. OWASP. "Error Handling." https://cheatsheetseries.owasp.org/cheatsheets/Error_Handling_Cheat_Sheet.html