Skip to content

CWE-209: Generation of Error Message Containing Sensitive Information (database)

Plugin ID

209.2

Supporting Research Documentation

Vulnerability Description

The application was found to return database error messages. Determining the type of database may assist attackers in exploiting SQL Injection attacks against the system. While debug messages are helpful during development and debugging, they should not be presented to users when an error occurs.

Remediation Text

Applications should handle database error conditions internally and map known failure types to error codes that can be displayed to a user. These error codes should be customized to the application and returned along with the relevant HTTP error code.

When an error occurs, the application identifies the error type or class, and displays a numerical value to the 
user. Requests should also be tracked so when a user is presented with an error code, it has a corresponding request ID. 
Support teams can then correlate the HTTP error, the customized error code, and the request ID in the log files to 
determine the root cause of the error without leaking details to the end user.

Example of returning customized errors:
```
HTTP/1.1 500 Internal Server Error
...
Error [0004] Occurred, please contact support or re-try your request again shortly.
Request ID [a4bc91def12]
...
```

External Links

Implementation plan

  • Add documentation for check to GitLab documentation
  • Add integration test for check
  • Add end-to-end test for check
    • Verify that the summary for the found vulnerability is helpful
    • Verify that the URL in the evidence shows the URL that generated the content
  • Update the check uniqueness template to contain {request_method}{request_path} instead of {request_url}
  • See if there is a way to optimize or validate the regular expressions in the YAML file (many IDEs do this)
  • Release Browserker, adding a changelog entry about the supported check
  • Update DAST to the latest Browserker
  • Disable ZAP check IDs that are defined in the YAML file when a browser-based scan
  • Enable new Browserker check when a browser-based scan
Edited by Aditya Tiwari