CWE-211, Externally-Generated Error Message Containing Sensitive Information, happens when an operation triggers a diagnostic or error message that your product does not write or control. MITRE's example is an error from the language interpreter. That error can contain sensitive system information.
It is most associated with PHP in MITRE's platform list, but the pattern is general: the runtime speaks, and your application lets it speak to the user.
How it happens
The record's observed examples show how an attacker triggers the runtime error:
- CVE-2004-1579: a single quote inserted into a SQL query produces an invalid query, which triggers full path disclosure. MITRE notes it may result from the more general SQL injection issue.
- CVE-2004-1581 and CVE-2005-0459: chains where the product does not protect against direct requests of an include or library file, leading to path disclosure when the file fails to run.
- CVE-2005-0443: an invalid parameter causes a failure to find an include file, leaking information in the error.
What an attacker gains
MITRE lists confidentiality: reading application data. A leaked path or query shapes the next attack, such as an injection or traversal attempt aimed at the real file layout.
How to find it
Send unexpected input: a stray quote, an empty value, a missing parameter. Request internal files directly. Read the response for paths, line numbers and SQL text. A dynamic scan automates this.
How to fix it
MITRE's mitigations:
- Configure the environment so errors are not displayed. For example, in PHP, disable display_errors.
- Keep debug output out of production through build and environment hardening.
- Handle exceptions internally and show default error pages instead of the raw error.
- Avoid the bugs that trigger the error. Fatal errors such as divide-by-zero are a typical trigger. You will not always control error pages, and not every language handles exceptions, so fixing the underlying bug is the best prevention.
; php.ini for production
display_errors = Off
log_errors = On
Quick check
Why does a single quote matter?
If it breaks the SQL statement, the database or runtime error may be shown to the user, and the error can include a full path.
