CWE-359, Exposure of Private Personal Information to an Unauthorized Actor, is about a person's private data reaching people who are not explicitly authorized to see it, or who lack the person's implicit consent. It is a security weakness and a privacy one at the same time.
Anyone who collects names, addresses, locations, photos or documents from users is in scope. That covers most applications.
How it happens
Private data enters a program in many ways. MITRE's detection notes list direct input from the user, such as a password or personal details, reads from a database or another source, and data derived from other data. Once it is in, it can leave through paths nobody planned.
The classic quiet leak is metadata. The observed examples in the record make the point.
- CVE-2023-29850: a library management product did not strip Exif data from images.
- CVE-2020-26220: a customer relationship management product did not strip Exif data from images.
- CVE-2005-0406: some image editors modified a JPEG but left the original Exif thumbnail intact in the file.
Exif is a metadata format inside images. MITRE notes it can contain potentially sensitive information such as geolocation, date and time. A user uploads a photo to a public profile, and the file carries more than the picture.
Other common routes: verbose logs, error messages, debug endpoints, backups, shared documents with hidden fields, and developers who store private data on the file system or registry because they trust the operating environment.
What an attacker gains
MITRE lists confidentiality: reading application data. The harm is to the person the data describes, and it can be hard to undo. A location, a name or an address, once exposed, stays exposed. For the organization, there are also regulatory consequences, which is why MITRE's mitigation list starts with law.
How to find it
MITRE lists several approaches.
- Architecture or design review: trace every way private data enters the program, where it is stored, and everywhere it leaves.
- Automated static analysis can find some instances by analyzing source code.
- Tools exist that analyze documents such as PDF and Word files to look for private information like names and addresses.
Add practical checks:
- Upload a photo with location data to your own application, then download it as another user. Inspect it for metadata.
- Read your logs and error responses for personal data.
- Check who can reach each stored copy of personal data, including backups and exports.
How to fix it
MITRE's mitigations are mostly design level.
- Requirements phase: identify and consult all relevant privacy regulations. MITRE lists examples such as GLBA, HIPAA, GDPR and CCPA. Which ones apply depends on your location, your business and the data you handle.
- Evaluate how secure design and privacy interact. Security says record everything so anomalies can be found. When private data is involved, that same log becomes a risk.
- Do not assume the environment is safe. Even if access to a resource is restricted, the people who have access may not be trustworthy. Storing private data in locally controlled resources is not enough.
- Reduce attack surface by stripping, redacting or sanitizing private information from documents, with human review where needed.
- When calling an external program to generate or convert documents, use any available options that avoid producing sensitive metadata.
Here is a short Python example that strips Exif from an uploaded image using Pillow, by copying only the pixels into a new image:
from PIL import Image
def strip_metadata(src, dst):
img = Image.open(src)
clean = Image.new(img.mode, img.size)
clean.putdata(list(img.getdata()))
clean.save(dst)
The new image has no Exif block, because nothing but pixel data was copied. It is not the fastest approach for large images, and some formats carry color profiles you may want to keep, so test with your own files. Run the stripping on the server, at upload time, not in the browser where a user can skip it.
Finally, minimize collection. Data you never store cannot leak.
Quick check
Why are image uploads a common leak?
Images can carry Exif metadata such as geolocation, date and time. If the product does not strip it, the data goes out with the image, as in CVE-2023-29850 and CVE-2020-26220.
Why can logging create privacy risk?
Security guidance says to record important operations, but when private data is involved the log itself holds that data and becomes something to protect.
What is the first step MITRE lists?
Identify and consult the privacy regulations that apply to your organization and the data it handles.
Sources
- MITRE CWE-359: https://cwe.mitre.org/data/definitions/359.html
