What is J2EE Misconfiguration: Missing Custom (CWE-7)?

TL;DR: J2EE Misconfiguration: Missing Custom Error Page (CWE-7) is a vulnerability that occurs when web applications fail to define custom error pages, exposing sensitive information about the product.

What is J2EE Misconfiguration: Missing Custom Error Page?

J2EE Misconfiguration: Missing Custom Error Page (CWE-7) is a type of vulnerability that occurs when web applications fail to define custom error pages, exposing sensitive information about the product. As defined by the MITRE Corporation under CWE-7, and classified by the OWASP Foundation under A09:2021 - Security Misconfiguration, this vulnerability can lead to sensitive information disclosure and enable attackers to target known vulnerabilities in the application container.

Quick Summary

J2EE Misconfiguration: Missing Custom Error Page (CWE-7) is a critical vulnerability that occurs when web applications fail to define custom error pages. This can expose sensitive information about the product, including database configuration and version numbers. Attackers can use this information to target known vulnerabilities in the application container.

Jump to: Quick Summary · J2EE Misconfiguration: Missing Custom Error Page Overview · How J2EE Misconfiguration: Missing Custom Error Page Works · Business Impact of J2EE Misconfiguration: Missing Custom Error Page · J2EE Misconfiguration: Missing Custom Error Page Attack Scenario · How to Detect J2EE Misconfiguration: Missing Custom Error Page · How to Fix J2EE Misconfiguration: Missing Custom Error Page · Framework-Specific Fixes for J2EE Misconfiguration: Missing Custom Error Page · How to Ask AI to Check Your Code for J2EE Misconfiguration: Missing Custom Error Page · J2EE Misconfiguration: Missing Custom Error Page Best Practices Checklist · J2EE Misconfiguration: Missing Custom Error Page FAQ · Vulnerabilities Related to J2EE Misconfiguration: Missing Custom Error Page · References · Scan Your Own Site

J2EE Misconfiguration: Missing Custom Error Page Overview

• What: J2EE Misconfiguration: Missing Custom Error Page (CWE-7) is a type of vulnerability that occurs when web applications fail to define custom error pages.
• Why it matters: This vulnerability can lead to sensitive information disclosure and enable attackers to target known vulnerabilities in the application container.
• Where it occurs: J2EE Misconfiguration: Missing Custom Error Page (CWE-7) typically occurs in web applications that use Java EE or J2EE technologies.
• Who is affected: Any organization that uses web applications with missing custom error pages may be vulnerable to this issue.
• Who is NOT affected: Applications that never construct paths/queries/commands from external input, and systems already using secure configuration practices.

How J2EE Misconfiguration: Missing Custom Error Page Works

Root Cause

The root cause of J2EE Misconfiguration: Missing Custom Error Page (CWE-7) is the failure to define custom error pages in web applications.

Attack Flow

1. The attacker sends a request to the web application that triggers an error.
2. Since the web application does not have a custom error page defined, it displays the default error page.
3. The default error page contains sensitive information about the product, including database configuration and version numbers.
4. The attacker uses this information to target known vulnerabilities in the application container.

Prerequisites to Exploit

• The web application must be using Java EE or J2EE technologies.
• The web application must not have a custom error page defined.
• The attacker must be able to send requests to the web application that trigger errors.

Vulnerable Code

public class MyServlet extends HttpServlet {
    public void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        // Do something that triggers an error
        throw new ServletException("Error message");
    }
}

This code does not define a custom error page, which makes it vulnerable to J2EE Misconfiguration: Missing Custom Error Page (CWE-7).

Secure Code

public class MyServlet extends HttpServlet {
    public void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        // Do something that triggers an error
        try {
            throw new ServletException("Error message");
        } catch (ServletException e) {
            // Display a custom error page with sensitive information removed
            response.sendError(HttpServletResponse.SC_INTERNAL_SERVER_ERROR);
        }
    }
}

This code defines a custom error page that removes sensitive information, making it secure against J2EE Misconfiguration: Missing Custom Error Page (CWE-7).

Business Impact of J2EE Misconfiguration: Missing Custom Error Page

• Confidentiality: The default error page contains sensitive information about the product, including database configuration and version numbers. This can be used by attackers to target known vulnerabilities in the application container.
• Integrity: The attacker may use the sensitive information to modify the web application’s configuration or inject malicious code.
• Availability: The web application may become unavailable due to the attacker’s actions.

J2EE Misconfiguration: Missing Custom Error Page Attack Scenario

1. The attacker sends a request to the web application that triggers an error.
2. Since the web application does not have a custom error page defined, it displays the default error page.
3. The attacker uses the sensitive information in the default error page to target known vulnerabilities in the application container.
4. The attacker exploits the vulnerability and gains access to the web application’s configuration.

How to Detect J2EE Misconfiguration: Missing Custom Error Page

Manual Testing

• Request a non-existent URL and trigger a 404/500 by sending malformed input, and check whether the response is a generic branded error page or a raw stack trace/server banner.
• Check the web application’s deployment descriptor (web.xml) for <error-page> entries covering common HTTP error codes and exception types.
• Confirm the custom error page itself doesn’t leak the same information (stack trace, server version) it’s meant to hide.

Automated Scanners (SAST / DAST)

Static analysis can check whether web.xml declares <error-page> mappings at all; dynamic testing is needed to confirm the deployed application actually serves the custom page instead of a container default when a real error is triggered at runtime.

PenScan Detection

PenScan’s Nikto and ZAP engines actively probe for default container error pages and stack-trace disclosure in HTTP responses.

False Positive Guidance

A finding on an endpoint that intentionally returns verbose errors in a non-production/debug environment isn’t a real issue in that environment — confirm the target is production or production-configured before treating it as a finding.

How to Fix J2EE Misconfiguration: Missing Custom Error Page

• Always define appropriate error pages in the web application’s code.
• Handle exceptions appropriately in source code to prevent sensitive information disclosure.
• Verify return values are correct to ensure that errors are handled correctly.

Framework-Specific Fixes for J2EE Misconfiguration: Missing Custom Error Page

For Java EE and J2EE applications, you can use the following framework-specific fixes:

// In web.xml:
<error-page>
    <exception-type>javax.servlet.ServletException</exception-type>
    <location>/error.jsp</location>
</error-page>

// In error.jsp:
<%@ page contentType="text/html" %>
<html>
    <body>
        Error message: <%= request.getAttribute("javax.servlet.error.message") %>
    </body>
</html>

This code defines a custom error page in Java EE and J2EE applications.

How to Ask AI to Check Your Code for J2EE Misconfiguration: Missing Custom Error Page

You can use the following copy-pasteable prompt with an AI coding assistant:

Review the following Java code block for potential CWE-7 J2EE Misconfiguration: Missing Custom Error Page vulnerabilities and rewrite it using custom error pages:

public class MyServlet extends HttpServlet {
    public void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        // Do something that triggers an error
        throw new ServletException("Error message");
    }
}

J2EE Misconfiguration: Missing Custom Error Page Best Practices Checklist

✅ Always define appropriate error pages in the web application’s code. ✅ Handle exceptions appropriately in source code to prevent sensitive information disclosure. ✅ Verify return values are correct to ensure that errors are handled correctly.

J2EE Misconfiguration: Missing Custom Error Page FAQ

How does J2EE Misconfiguration: Missing Custom Error Page occur?

J2EE Misconfiguration: Missing Custom Error Page occurs when web applications fail to define custom error pages, exposing sensitive information about the product.

What are the consequences of a J2EE Misconfiguration: Missing Custom Error Page vulnerability?

A stack trace might show the attacker a malformed SQL query string, the type of database being used, and the version of the application container. This information enables the attacker to target known vulnerabilities in these components.

How can I detect J2EE Misconfiguration: Missing Custom Error Page in my web application?

You can use automated scanners or manual testing to identify missing custom error pages.

What are some best practices for preventing J2EE Misconfiguration: Missing Custom Error Page?

Always define appropriate error pages, handle exceptions appropriately in source code, and verify return values are correct.

How can I fix a J2EE Misconfiguration: Missing Custom Error Page vulnerability in my web application?

You can use the OWASP Security Cheat Sheet to guide you through the remediation process.

What is the relationship between CWE-7 and other vulnerabilities?

CWE-756 (Missing Custom Error Page) is a more specific variant of CWE-7.

How can I ask AI to check my code for J2EE Misconfiguration: Missing Custom Error Page?

You can use a copy-pasteable prompt with an AI coding assistant to review your code and provide recommendations.

Vulnerabilities Related to J2EE Misconfiguration: Missing Custom Error Page

This table lists the related vulnerabilities for J2EE Misconfiguration: Missing Custom Error Page (CWE-7).

References

• MITRE CWE-7
• CAPEC (None)
• NVD

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find J2EE Misconfiguration: Missing Custom Error Page and other risks before an attacker does.