CWE-536, Servlet Runtime Error Message Containing Sensitive Information, is a Java web weakness. MITRE describes a servlet error message that shows there is an unhandled exception in the application code and may give an attacker useful information.
How it happens
A servlet reads a request parameter and uses it without checking. When the parameter is missing, the code throws a runtime exception. Nothing catches it, so the container shows its default error output, which may include a full stack trace.
MITRE's example is a servlet that reads a username parameter and calls length() on it, with a comment noting it may cause an unchecked NullPointerException. This is the shape of the problem:
// Vulnerable: no handling for a missing parameter
public void doPost(HttpServletRequest request, HttpServletResponse response)
throws ServletException, IOException {
String username = request.getParameter("username");
if (username.length() < 10) {
// ...
}
}
Send a request without username and the container may print the trace.
What an attacker gains
MITRE lists a confidentiality impact. The error message may contain the location of the file holding the offending function. That can disclose the web root's absolute path and tell the attacker where a function lives. Class names and framework details in a trace help them choose what to try next.
How to find it
- Send requests with missing, empty and oversized parameters and read the error responses.
- Review servlets for places where a request value is used before it is checked.
- Check whether the application defines error pages in its deployment descriptor.
How to fix it
MITRE's page for this entry lists no formal mitigations. Based on its example and description:
- Validate parameters before use.
- Catch runtime exceptions in the servlet or in a common filter and return a plain error response.
- Configure error pages so the container never prints a trace to the user.
- Log the full exception on the server.
String username = request.getParameter("username");
if (username == null || username.length() >= 10) {
response.sendError(HttpServletResponse.SC_BAD_REQUEST, "Invalid request");
return;
}
Quick check
What does a stack trace give an attacker that a generic error does not?
File locations, which can reveal the web root path, plus function and class names that show how the application is built.
