CWE-212, Improper Removal of Sensitive Information Before Storage or Transfer, covers a product that stores, transfers or shares a resource containing sensitive information without properly removing that information first, so unauthorized actors can reach it.
The resource can be a document, packet, message or database. The data may be useful to the people who share it inside a small group but must be cleansed, or scrubbed, before it leaves that group.
If your product accepts uploads, exports files, proxies requests or publishes documents, this applies to you.
How it happens
MITRE gives two plain examples. A document editor might not remove reviewer comments or the local pathname where the document is stored. A proxy might not remove an internal IP address from headers before sending a request to the internet.
The observed CVEs add more:
- CVE-2023-1974: a product does not remove EXIF data from images, which can include GPS coordinates.
- CVE-2020-26220: a customer relationship management product does not strip Exif data from images.
- CVE-2019-3733: a cryptography library does not clear heap memory before release.
- CVE-2005-0406: some image editors modify a JPEG but leave the original EXIF thumbnail inside the file.
Vulnerable pattern
# Vulnerable: stores the upload exactly as received,
# including EXIF GPS tags, then serves it publicly
def save_avatar(upload):
upload.save(f"/srv/public/avatars/{upload.filename}")
What an attacker gains
MITRE lists confidentiality: reading files, directories and application data. Exposed system data such as file locations can help with later attacks, and the secondary consequences depend on what was in the resource. A photo with GPS coordinates can reveal where someone lives or works.
How to find it
MITRE notes that tools exist which analyze documents such as PDF and Word files for private information like names and addresses.
You can also check by hand:
- Take a file as your product would export or publish it, and open its metadata with a tool such as exiftool or the document properties dialog.
- Look at outbound requests from any proxy or gateway and compare them to inbound ones.
- Review what gets written to shared storage, backups and support bundles.
How to fix it
MITRE's guidance, in order:
- Specify what is sensitive. State which information counts as private, and require that the product can cleanse it before publishing or exporting.
- Compartmentalize. Define trust boundaries, keep sensitive data inside them, and apply least privilege.
- Sanitize automatically, then review. Some tools can redact, strip or sanitize private information from documents, though some human review may be needed. Formats differ in what these tools can process.
- Configure converters. When your product calls an external program to generate or convert documents, use any options that avoid producing sensitive metadata.
from PIL import Image
def save_avatar(upload):
img = Image.open(upload)
clean = Image.new(img.mode, img.size)
clean.putdata(list(img.getdata())) # copies pixels only, drops EXIF
clean.save(f"/srv/public/avatars/{safe_name(upload.filename)}")
Re-encoding from pixel data drops metadata. Test with your own image formats, and consider a purpose-built library for formats you cannot re-encode safely.
For memory, see CWE-226: clear buffers before releasing them.
Quick check
Is deleting the metadata field in the UI enough?
Not always. As the JPEG thumbnail example shows, a copy of the original can remain inside the file. Inspect the output file itself.
Does this only apply to files?
No. Headers, packets, messages and memory buffers can all carry data that should be removed first.
