Information disclosure through error messages

Description

Returning exception messages, stack traces, SQL errors, or internal paths directly to users can reveal system structure and vulnerable input points. In production, return generic errors and keep details in server logs.

Potential impact

• Disclosure of internal paths, class names, and query structure.
• Assistance with vulnerability discovery and automated attacks.
• Disclosure of sensitive data contained in exception messages.

Remediation

1. Return generic error messages to users.
2. Record detailed exceptions in access-controlled server logs.
3. Disable framework debug pages and detailed error responses in production.

Examples

Before

catch (Exception e) {
    response.getWriter().write(e.getMessage());
}

After

catch (Exception e) {
    logger.warn("request failed", e);
    response.sendError(500, "Internal server error");
}

Explanation:

• Before: Including getMessage or getLocalizedMessage output directly in an HTTP body or error response can disclose paths, SQL errors, configuration values, and library behavior.
• After: Exception details stay in server logs, while the client receives a generic error message.

References

• CWE-209
• OWASP Error Handling Cheat Sheet