What is Exposure of Sensitive Information (CWE-202)?

TL;DR: Exposure of Sensitive Information Through Data Queries (CWE-202) occurs when an attacker infers sensitive information by using statistics. To fix it, use secure coding practices, such as input validation and sanitization, and implement access controls.

At-a-Glance

What is Exposure of Sensitive Information Through Data Queries?

Exposure of Sensitive Information Through Data Queries (CWE-202) is a type of vulnerability that occurs when an attacker infers sensitive information by using statistics. As defined by the MITRE Corporation under CWE-202, and classified by the OWASP Foundation as not directly mapped.

Quick Summary

Exposure of Sensitive Information Through Data Queries (CWE-202) can lead to confidentiality breaches, such as reading files or directories and reading application data. It is essential to prevent CWE-202 in your code to maintain the security of your database and web application. You can use secure coding practices, such as input validation and sanitization, and implement access controls to prevent CWE-202.

Jump to: Quick Summary · Exposure of Sensitive Information Through Data Queries Overview · How Exposure of Sensitive Information Through Data Queries Works · Business Impact of Exposure of Sensitive Information Through Data Queries · Exposure of Sensitive Information Through Data Queries Attack Scenario · How to Detect Exposure of Sensitive Information Through Data Queries · How to Fix Exposure of Sensitive Information Through Data Queries · Framework-Specific Fixes for Exposure of Sensitive Information Through Data Queries · How to Ask AI to Check Your Code for Exposure of Sensitive Information Through Data Queries · Exposure of Sensitive Information Through Data Queries Best Practices Checklist · Exposure of Sensitive Information Through Data Queries FAQ · Vulnerabilities Related to Exposure of Sensitive Information Through Data Queries · References · Scan Your Own Site

Exposure of Sensitive Information Through Data Queries Overview

What

Exposure of Sensitive Information Through Data Queries (CWE-202) occurs when an attacker infers sensitive information by using statistics.

Why it matters

CWE-202 can lead to confidentiality breaches, such as reading files or directories and reading application data. It is essential to prevent CWE-202 in your code to maintain the security of your database and web application.

Where it occurs

Exposure of Sensitive Information Through Data Queries (CWE-202) can occur in any system that uses statistics to infer sensitive information, including databases and web applications.

Who is affected

Any user who has access to the system or data being queried can be affected by CWE-202.

Who is NOT affected

Users who do not have access to the system or data being queried are not affected by CWE-202.

How Exposure of Sensitive Information Through Data Queries Works

Root Cause

The root cause of CWE-202 is an attacker inferring sensitive information by using statistics.

Attack Flow

1. The attacker uses statistical analysis to infer sensitive information.
2. The attacker gains access to the system or data being queried.
3. The attacker uses the inferred information to compromise the security of the system.

Prerequisites to Exploit

• The attacker must have access to the system or data being queried.
• The attacker must be able to use statistical analysis to infer sensitive information.

Vulnerable Code

SELECT * FROM users WHERE id = '123'

This code is vulnerable because it allows an attacker to infer sensitive information by using statistics. The attacker can use the id parameter to infer the sensitive information.

Secure Code

SELECT * FROM users WHERE id = ? AND id IN (SELECT id FROM user_access)

This code is secure because it uses input validation and sanitization to prevent an attacker from inferring sensitive information by using statistics. The ? placeholder is used to prevent SQL injection attacks, and the IN clause is used to restrict access to authorized users.

Business Impact of Exposure of Sensitive Information Through Data Queries

Confidentiality

Exposure of Sensitive Information Through Data Queries (CWE-202) can lead to confidentiality breaches, such as reading files or directories and reading application data. This can result in sensitive information being compromised, including personal identifiable information (PII), financial information, and confidential business data.

Integrity

Exposure of Sensitive Information Through Data Queries (CWE-202) can also lead to integrity breaches, such as modifying or deleting data. This can result in unauthorized changes to the system or data being queried.

Availability

Exposure of Sensitive Information Through Data Queries (CWE-202) can also lead to availability breaches, such as disrupting the normal functioning of the system or data being queried.

Exposure of Sensitive Information Through Data Queries Attack Scenario

1. The attacker uses statistical analysis to infer sensitive information.
2. The attacker gains access to the system or data being queried.
3. The attacker uses the inferred information to compromise the security of the system.

How to Detect Exposure of Sensitive Information Through Data Queries

Manual Testing

• Use a database management tool to analyze the database schema and identify potential vulnerabilities.
• Review the code for any statistical analysis or data querying functions that may be vulnerable to CWE-202.

Automated Scanners (SAST / DAST)

Automated scanners can detect CWE-202 by analyzing the code and identifying potential vulnerabilities. However, dynamic testing is required to confirm whether the vulnerability exists in runtime.

PenScan Detection

PenScan’s scanner engines are designed to detect CWE-202 by analyzing the code and identifying potential vulnerabilities.

False Positive Guidance

When reviewing the results of an automated scan or manual testing, be aware that some findings may be false positives. For example, if a pattern looks risky but is actually safe due to context that a scanner cannot see, it should not be reported as CWE-202.

How to Fix Exposure of Sensitive Information Through Data Queries

• Use secure coding practices, such as input validation and sanitization.
• Implement access controls to restrict access to authorized users.
• Regularly review and update the code to ensure that it is free from vulnerabilities.

Framework-Specific Fixes for Exposure of Sensitive Information Through Data Queries

Java

SELECT * FROM users WHERE id = ? AND id IN (SELECT id FROM user_access)

This code uses input validation and sanitization to prevent an attacker from inferring sensitive information by using statistics. The ? placeholder is used to prevent SQL injection attacks, and the IN clause is used to restrict access to authorized users.

Node.js

const query = 'SELECT * FROM users WHERE id = ? AND id IN (SELECT id FROM user_access)';
db.query(query, [id], function(err, results) {
  // ...
});

This code uses input validation and sanitization to prevent an attacker from inferring sensitive information by using statistics. The ? placeholder is used to prevent SQL injection attacks, and the IN clause is used to restrict access to authorized users.

Python/Django

from django.db import models

class User(models.Model):
    id = models.AutoField(primary_key=True)
    # ...

query = 'SELECT * FROM users WHERE id = ? AND id IN (SELECT id FROM user_access)'
users = User.objects.raw(query, [id])

This code uses input validation and sanitization to prevent an attacker from inferring sensitive information by using statistics. The ? placeholder is used to prevent SQL injection attacks, and the IN clause is used to restrict access to authorized users.

PHP

$query = 'SELECT * FROM users WHERE id = ? AND id IN (SELECT id FROM user_access)';
$stmt = $db->prepare($query);
$stmt->execute([$id]);

This code uses input validation and sanitization to prevent an attacker from inferring sensitive information by using statistics. The ? placeholder is used to prevent SQL injection attacks, and the IN clause is used to restrict access to authorized users.

How to Ask AI to Check Your Code for Exposure of Sensitive Information Through Data Queries

To ask AI to check your code for CWE-202 vulnerabilities, you can use a copy-paste prompt with an AI coding assistant. For example:

“Review the following [language] code block for potential CWE-202 Exposure of Sensitive Information Through Data Queries vulnerabilities and rewrite it using secure input validation and sanitization.”

Exposure of Sensitive Information Through Data Queries Best Practices Checklist

✅ Use secure coding practices, such as input validation and sanitization. ✅ Implement access controls to restrict access to authorized users. ✅ Regularly review and update the code to ensure that it is free from vulnerabilities.

Exposure of Sensitive Information Through Data Queries FAQ

How does Exposure of Sensitive Information Through Data Queries occur?

Exposure of Sensitive Information Through Data Queries occurs when an attacker infers sensitive information by using statistics.

What are the common consequences of CWE-202?

The common consequences of CWE-202 include confidentiality breaches, such as reading files or directories and reading application data.

How can I detect CWE-202 in my code?

You can use manual testing, automated scanners (SAST / DAST), PenScan detection, or a combination of these methods to detect CWE-202.

What are the potential mitigations for CWE-202?

The potential mitigations for CWE-202 include using secure coding practices, such as input validation and sanitization, and implementing access controls.

How can I prevent CWE-202 in my code?

You can use secure coding practices, such as input validation and sanitization, and implement access controls to prevent CWE-202.

What are the related weaknesses to CWE-202?

The related weaknesses to CWE-202 include Exposure of Sensitive Information Through Metadata (CWE-1230).

How can I ask AI to check my code for CWE-202 vulnerabilities?

You can use a copy-paste prompt with an AI coding assistant, such as “Review the following [language] code block for potential CWE-202 Exposure of Sensitive Information Through Data Queries vulnerabilities and rewrite it using secure input validation and sanitization.”

Vulnerabilities Related to Exposure of Sensitive Information Through Data Queries

References

• https://cwe.mitre.org/data/definitions/202.html
• https://nvd.nist.gov/

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Exposure of Sensitive Information Through Data Queries and other risks before an attacker does.