What is Externally-Generated Error Message (CWE-211)?

TL;DR: Externally-Generated Error Message Containing Sensitive Information (CWE-211) is a security vulnerability that occurs when an application generates an error message containing sensitive system information, allowing attackers to plan attacks and exploit vulnerabilities.

At-a-Glance

What is Externally-Generated Error Message Containing Sensitive Information?

Externally-Generated Error Message Containing Sensitive Information (CWE-211) is a type of security vulnerability that occurs when an application generates an error message containing sensitive system information. As defined by the MITRE Corporation under CWE-211, and classified by the OWASP Foundation under A05:2025 - Security Misconfiguration, this vulnerability can allow attackers to plan attacks and exploit vulnerabilities.

Quick Summary

Externally-Generated Error Message Containing Sensitive Information (CWE-211) is a security vulnerability that occurs when an application generates an error message containing sensitive system information. This vulnerability can allow attackers to plan attacks and exploit vulnerabilities, leading to data breaches and system compromise. It’s essential to prevent this vulnerability by configuring your application’s environment to prevent errors from being generated.

Jump to: Quick Summary · Externally-Generated Error Message Containing Sensitive Information Overview · How Externally-Generated Error Message Containing Sensitive Information Works · Business Impact of Externally-Generated Error Message Containing Sensitive Information · Externally-Generated Error Message Containing Sensitive Information Attack Scenario · How to Detect Externally-Generated Error Message Containing Sensitive Information · How to Fix Externally-Generated Error Message Containing Sensitive Information · Framework-Specific Fixes for Externally-Generated Error Message Containing Sensitive Information · How to Ask AI to Check Your Code for Externally-Generated Error Message Containing Sensitive Information · Externally-Generated Error Message Containing Sensitive Information Best Practices Checklist · Externally-Generated Error Message Containing Sensitive Information FAQ · Vulnerabilities Related to Externally-Generated Error Message Containing Sensitive Information · References · Scan Your Own Site

Externally-Generated Error Message Containing Sensitive Information Overview

What

Externally-Generated Error Message Containing Sensitive Information (CWE-211) is a security vulnerability that occurs when an application generates an error message containing sensitive system information.

Why it matters

A CWE-211 vulnerability can allow attackers to plan attacks and exploit vulnerabilities, leading to data breaches and system compromise. It’s essential to prevent this vulnerability by configuring your application’s environment to prevent errors from being generated.

Where it occurs

This vulnerability can occur in any application that generates error messages containing sensitive system information.

Who is affected

Any user who interacts with the vulnerable application may be affected by this vulnerability.

Who is NOT affected

Applications that never construct paths/queries/commands from external input are not affected by this vulnerability.

How Externally-Generated Error Message Containing Sensitive Information Works

Root Cause

The root cause of CWE-211 is an externally-generated error message containing sensitive system information.

Attack Flow

1. The attacker sends a request to the vulnerable application.
2. The application generates an error message containing sensitive system information.
3. The attacker uses the sensitive information to plan attacks and exploit vulnerabilities.

Prerequisites to Exploit

• The attacker must send a request to the vulnerable application.
• The application must generate an error message containing sensitive system information.

Vulnerable Code

error_log("Error: " . $_GET['error']);

This code generates an error message containing sensitive system information, making it vulnerable to CWE-211.

Secure Code

try {
    // Code that may throw an exception
} catch (Exception $e) {
    error_log("Error: " . $e->getMessage());
}

This secure code handles exceptions internally and does not display errors containing sensitive information to users.

Business Impact of Externally-Generated Error Message Containing Sensitive Information

Confidentiality

The exposure of sensitive system information can allow attackers to plan attacks and exploit vulnerabilities, leading to data breaches and system compromise.

Integrity

The exposure of sensitive system information can also allow attackers to modify or delete sensitive data, compromising the integrity of the application.

Availability

The exposure of sensitive system information can also disrupt the availability of the application, making it unavailable to users.

Externally-Generated Error Message Containing Sensitive Information Attack Scenario

1. The attacker sends a request to the vulnerable application.
2. The application generates an error message containing sensitive system information.
3. The attacker uses the sensitive information to plan attacks and exploit vulnerabilities.

How to Detect Externally-Generated Error Message Containing Sensitive Information

Manual Testing

• Review logs and error pages for sensitive system information.
• Use a debugger or logging tool to inspect the application’s behavior.

Automated Scanners (SAST / DAST)

• Use an automated scanner to detect CWE-211 vulnerabilities in your code.
• Note that static analysis may not catch all instances of this vulnerability, as some may require dynamic/runtime testing.

PenScan Detection

PenScan’s automated scan engines actively test for CWE-211, ensuring you catch this vulnerability before an attacker does.

False Positive Guidance

Be cautious when reviewing findings from automated scanners, as some patterns may look risky but are actually safe due to context that the scanner can’t see. Verify findings with manual testing and review code changes carefully.

How to Fix Externally-Generated Error Message Containing Sensitive Information

• Handle exceptions internally and do not display errors containing sensitive information to users.
• Create default error pages if necessary.
• Configure your application’s environment to prevent errors from being generated.

Framework-Specific Fixes for Externally-Generated Error Message Containing Sensitive Information

PHP

try {
    // Code that may throw an exception
} catch (Exception $e) {
    error_log("Error: " . $e->getMessage());
}

ASP.NET

try {
    // Code that may throw an exception
} catch (Exception e) {
    Server.GetLastError().ToString();
}

How to Ask AI to Check Your Code for Externally-Generated Error Message Containing Sensitive Information

You can use AI coding assistants to review your code for potential CWE-211 vulnerabilities and rewrite it using secure techniques.

Externally-Generated Error Message Containing Sensitive Information Best Practices Checklist

✅ Handle exceptions internally and do not display errors containing sensitive information to users. ✅ Create default error pages if necessary. ✅ Configure your application’s environment to prevent errors from being generated.

Externally-Generated Error Message Containing Sensitive Information FAQ

How do I identify Externally-Generated Error Message Containing Sensitive Information in my code?

Look for error messages that contain sensitive system information. Check your logs and error pages to see if they reveal any internal details.

What are the consequences of a CWE-211 vulnerability?

A CWE-211 vulnerability can allow attackers to plan attacks and exploit vulnerabilities, leading to data breaches and system compromise.

How do I prevent Externally-Generated Error Message Containing Sensitive Information in my code?

Configure your application’s environment to prevent errors from being generated. Use environment hardening and compilation or build hardening techniques.

Can AI assistants help me detect CWE-211 vulnerabilities?

Yes, you can use AI coding assistants to review your code for potential CWE-211 vulnerabilities and rewrite it using secure techniques.

What are the best practices for preventing CWE-211 vulnerabilities?

Use environment hardening, compilation or build hardening, and handle exceptions internally. Create default error pages if necessary.

How do I fix a CWE-211 vulnerability in my code?

Handle exceptions internally and do not display errors containing sensitive information to users. Create default error pages if necessary.

Can I use automated scanners to detect CWE-211 vulnerabilities?

Yes, you can use automated scanners like PenScan’s engines to detect CWE-211 vulnerabilities in your code.

Vulnerabilities Related to Externally-Generated Error Message Containing Sensitive Information

References

• MITRE CWE-211
• NVD

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Externally-Generated Error Message Containing Sensitive Information and other risks before an attacker does.