What is Self-generated Error Message Containing (CWE-210)?

TL;DR: Self-generated Error Message Containing Sensitive Information (CWE-210) is a vulnerability that occurs when web applications generate error messages containing sensitive information. This can lead to unauthorized access to sensitive data, compromising confidentiality and integrity.

At-a-Glance Table

What is Self-generated Error Message Containing Sensitive Information?

Self-generated Error Message Containing Sensitive Information (CWE-210) is a vulnerability that occurs when a web application generates error messages that contain sensitive information. This can include database credentials, user authentication details, or other confidential data.

As defined by the MITRE Corporation under CWE-210, and classified by the OWASP Foundation under A05:2025 - Security Misconfiguration, this type of vulnerability poses a significant risk to confidentiality and integrity.

Quick Summary

Self-generated Error Message Containing Sensitive Information (CWE-210) is a critical vulnerability that can lead to unauthorized access to sensitive data. It occurs when web applications generate error messages containing sensitive information. To prevent CWE-210 vulnerabilities, ensure that error messages do not contain sensitive information and implement proper logging mechanisms.

Jump to: What is Self-generated Error Message Containing Sensitive Information? · Quick Summary · Self-generated Error Message Containing Sensitive Information Overview · How Self-generated Error Message Containing Sensitive Information Works · Business Impact of Self-generated Error Message Containing Sensitive Information · Self-generated Error Message Containing Sensitive Information Attack Scenario · How to Detect Self-generated Error Message Containing Sensitive Information · How to Fix Self-generated Error Message Containing Sensitive Information · Framework-Specific Fixes for Self-generated Error Message Containing Sensitive Information · How to Ask AI to Check Your Code for Self-generated Error Message Containing Sensitive Information · Self-generated Error Message Containing Sensitive Information Best Practices Checklist · Self-generated Error Message Containing Sensitive Information FAQ · Vulnerabilities Related to Self-generated Error Message Containing Sensitive Information · References · Scan Your Own Site

Self-generated Error Message Containing Sensitive Information Overview

What: Self-generated Error Message Containing Sensitive Information (CWE-210) is a vulnerability that occurs when web applications generate error messages containing sensitive information.

Why it matters: CWE-210 vulnerabilities can lead to unauthorized access to sensitive data, compromising confidentiality and integrity. They are often caused by inadequate logging mechanisms or the inclusion of sensitive information in error messages.

Where it occurs: CWE-210 vulnerabilities typically occur in web applications that handle user input or interact with databases.

Who is affected: All users who interact with a vulnerable application may be affected by CWE-210 vulnerabilities.

Who is NOT affected: Applications that never construct paths/queries/commands from external input are not affected by CWE-210 vulnerabilities.

How Self-generated Error Message Containing Sensitive Information Works

Root Cause

CWE-210 vulnerabilities occur when web applications generate error messages containing sensitive information. This can include database credentials, user authentication details, or other confidential data.

Attack Flow

1. The attacker sends a malicious request to the vulnerable application.
2. The application generates an error message containing sensitive information.
3. The attacker extracts the sensitive information from the error message.

Prerequisites to Exploit

• The attacker must be able to send a malicious request to the vulnerable application.
• The application must generate an error message containing sensitive information.

Vulnerable Code

import logging

def handle_request(request):
    try:
        # Simulate database query
        db.query("SELECT * FROM users WHERE username = '" + request.username + "'")
    except Exception as e:
        # Log the exception, including sensitive information
        logging.error(f"Error: {e} (username: {request.username})")

# Vulnerable code that generates an error message containing sensitive information

Secure Code

import logging

def handle_request(request):
    try:
        # Simulate database query
        db.query("SELECT * FROM users WHERE username = '" + request.username + "'")
    except Exception as e:
        # Log the exception without including sensitive information
        logging.error(f"Error: {e}")

Business Impact of Self-generated Error Message Containing Sensitive Information

Confidentiality: CWE-210 vulnerabilities can lead to unauthorized access to sensitive data, compromising confidentiality.

• Data exposure: Sensitive information may be exposed in error messages.
• Unauthorized access: Attackers may gain access to sensitive areas of the application.

Integrity: CWE-210 vulnerabilities can compromise the integrity of sensitive data.

• Data tampering: Sensitive information may be modified or deleted by attackers.
• Unauthorized changes: Attackers may make unauthorized changes to sensitive data.

Availability: CWE-210 vulnerabilities can disrupt the availability of sensitive data.

• Data loss: Sensitive information may be lost due to unauthorized access or modifications.
• System downtime: The application may become unavailable due to repeated attacks.

Self-generated Error Message Containing Sensitive Information Attack Scenario

1. The attacker sends a malicious request to the vulnerable application.
2. The application generates an error message containing sensitive information.
3. The attacker extracts the sensitive information from the error message and uses it for further attacks.

How to Detect Self-generated Error Message Containing Sensitive Information

Manual Testing

• Review error messages generated by the application for sensitive information.
• Check logging mechanisms for inclusion of sensitive information.
• Test user input handling and database interactions for potential vulnerabilities.

Automated Scanners (SAST / DAST)

• Use automated tools to scan the application for CWE-210 vulnerabilities.
• Identify potential issues in error messages and logging mechanisms.

PenScan Detection

• PenScan’s scanner engines actively test for CWE-210 vulnerabilities, providing actionable insights to secure your application.

False Positive Guidance

• Be cautious of false positives caused by legitimate error messages or logging mechanisms.
• Review findings carefully to ensure accuracy.

How to Fix Self-generated Error Message Containing Sensitive Information

• Implement proper logging mechanisms that exclude sensitive information.
• Ensure error messages do not contain sensitive information.
• Regularly review and update error handling and logging mechanisms.

Framework-Specific Fixes for Self-generated Error Message Containing Sensitive Information

Java

import java.util.logging.Logger;

public class ErrorHandler {
    private static final Logger logger = Logger.getLogger(ErrorHandler.class.getName());

    public void handleException(Exception e) {
        // Log the exception without including sensitive information
        logger.severe("Error: " + e.getMessage());
    }
}

Node.js

const logger = require('logger');

function handleError(error) {
    // Log the error without including sensitive information
    logger.error('Error:', error);
}

module.exports = handleError;

How to Ask AI to Check Your Code for Self-generated Error Message Containing Sensitive Information

Review the following [language] code block for potential CWE-210 Self-generated Error Message Containing Sensitive Information vulnerabilities and rewrite it using primary fix technique:

import logging

def handle_request(request):
    try:
        # Simulate database query
        db.query("SELECT * FROM users WHERE username = '" + request.username + "'")
    except Exception as e:
        # Log the exception without including sensitive information
        logging.error(f"Error: {e}")

Self-generated Error Message Containing Sensitive Information Best Practices Checklist

✅ Review error messages generated by the application for sensitive information. ✅ Check logging mechanisms for inclusion of sensitive information. ✅ Test user input handling and database interactions for potential vulnerabilities.

Self-generated Error Message Containing Sensitive Information FAQ

How does CWE-210 occur in web applications?

CWE-210 occurs when a web application generates error messages that contain sensitive information, such as database credentials or user authentication details.

What are the potential consequences of CWE-210 vulnerabilities?

CWE-210 vulnerabilities can lead to unauthorized access to sensitive data, compromising confidentiality and integrity.

How can I prevent CWE-210 vulnerabilities in my application?

To prevent CWE-210 vulnerabilities, ensure that error messages do not contain sensitive information and implement proper logging mechanisms.

Can CWE-210 vulnerabilities be detected using automated tools?

Yes, CWE-210 vulnerabilities can be detected using automated tools, such as PenScan’s scanner engines.

What is the best practice for handling error messages in web applications?

The best practice for handling error messages in web applications is to ensure that they do not contain sensitive information and are properly logged.

How can I mitigate CWE-210 vulnerabilities in my application?

To mitigate CWE-210 vulnerabilities, implement proper logging mechanisms and ensure that error messages do not contain sensitive information.

Can CWE-210 vulnerabilities be prevented by using a web application firewall (WAF)?

No, CWE-210 vulnerabilities cannot be prevented solely by using a WAF; proper coding practices are also necessary.

Vulnerabilities Related to Self-generated Error Message Containing Sensitive Information

References

• MITRE CWE-210
• NVD

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Self-generated Error Message Containing Sensitive Information and other risks before an attacker does.