CWE-202, Exposure of Sensitive Information Through Data Queries, covers a quiet kind of leak. When trying to keep information confidential, an attacker can often infer some of it by using statistics. It matters for any system that offers search or aggregate queries over data that should stay private.
How it happens
MITRE describes situations where data should not be tied to individual users, but many users may run queries that scrub identity. If an attacker can specify search terms known to be unique to one person, the scrubbed result may still reveal facts about that person.
The record has one observed example, CVE-2022-41935. A wiki product allowed an adversary to discover filenames through a series of queries, starting with one letter and then iteratively extending the match. Each query only answered yes or no, but enough answers spelled out the secret.
What an attacker gains
MITRE lists confidentiality impact: files, directories or application data may be leaked accidentally through queries.
How to find it
The record lists no detection methods. Think like the attacker. If your search or report feature returns counts, matches or existence flags for data the caller cannot read, ask what a series of queries could reconstruct.
How to fix it
These are general steps, since the record lists no mitigations.
- Apply authorisation to search results the same way as to direct reads.
- Do not let prefix or partial matching confirm the existence of items the user cannot see.
- For aggregates, set a minimum group size and refuse queries that isolate a single person.
- Rate limit repeated, incrementally changing queries.
Quick check
Can a yes or no answer leak a secret?
Yes. Many yes or no answers to well chosen questions can reveal the whole value, one character at a time.
