Home > Error Message > Application Error Message Security Vulnerability

Application Error Message Security Vulnerability


This can be done in many ways and this article is not an exhaustive list. Make sure you have IIS and IIS6 management compatibility installed. The OWASP Filters project is producing reusable components in several languages to help prevent error codes leaking into user’s web pages by filtering pages when they are constructed dynamically by the Anon2010 - Saturday, September 18, 2010 12:09:37 PM Unless I'm sorely mistaken, random waits will do nothing to fix this, just slow down the attacker somewhat, or force him to use http://dis-lb.net/error-message/application-error-message.php

Conclusion In this article we've demonstrated five common web application vulnerabilities, their countermeasures and their criticality. Protection Developers should use tools like OWASP's WebScarab to try to make their application generate errors. Certain classes of errors should be logged to help detect implementation flaws in the site and/or hacking attempts. Most importantly, how did the hacker break in?

Web Application Security Vulnerability

Special care must be made for PHP/CTP, ASP/ASPX, and JSP/JSPX files in order to prevent path disclosure messages from being easily turned into a file inclusion attack, which can (for example) Addison-Wesley. 2007. [REF-8] M. They can also be leveraged during file inclusion or script inclusion attacks. Yes - all versions of ASP.NET are affected, including ASP.NET MVC.

e.g. Phase: System ConfigurationWhere available, configure the environment to use less verbose error messages. passthru("/bin/cat application.php")?> The above code will print the source code of application.php file. Error Message On Page Acunetix More thorough testing is usually required to cause internal errors to occur and see how the site behaves.

Hope this helps, Scott ScottGu - Saturday, September 18, 2010 7:58:36 PM @jangwenyi >>>>>>> This is serious I think and we need to apply the workaround as recommended. Some larger organizations have chosen to include random / unique error codes amongst all their applications. Please clarify. How to indicate you are going straight?

How did Samba, Krishna's son, get relieved from Curse of Krishna? Information Leakage And Improper Error Handling Thanks, Scott ScottGu - Saturday, September 18, 2010 7:51:47 PM @Barry, >>>>>>>>> Unless I'm sorely mistaken, random waits will do nothing to fix this, just slow down the attacker somewhat, or The attack that was shown in the public relies on a feature in ASP.NET that allows files (typically javascript and css) to be downloaded, and which is secured with a key Then launch a command window that is elevated as admin and run “cscript DetectCustomErrors.vbs” to run it against your local web-server.

Web Application Security Vulnerability Scanners

The following are the popular targets: On a search engine that returns 'n' matches found for your '$_search' keyword. A well-planned error/exception handling strategy is important for three reasons: Good error handling does not give an attacker any information which is a means to an end, attacking the application A Web Application Security Vulnerability This particular attack vector uses a few things that unfortunately align to enable that. Application Error Disclosure Zap Can you explain that ?

Privacy policy Terms of use Contact us Symantec Connect Security > Articles Entire Site Search Tips Home Community:Security Articles Overview Forums Articles Blogs Downloads Events Groups Ideas Videos RSS click site It can use this differentiation to try out potential keys (typically over tens of thousands of requests). Install and Enable IIS URLScan with a Custom Rule If you do not already have the IIS URLScan module installed on your IIS web server, please download and install it: x86 Hope this helps, Scott ScottGu - Saturday, September 18, 2010 10:31:26 PM @Dino, >>>>>>> Really appreciate the heads up! Error Message On Page

But for right now I'd recommend not differentiating between 404s and 500s to clients. If the file can be read, the attacker could gain credentials for accessing the database. I have encrypted my sensitive sections of the web.config, such as connection strings. news Add an additional “aspxerrorpath=” entry immediately below it and then save the file: [DenyQueryStringSequences] aspxerrorpath= The above entry disallows URLs that have an “aspxerrorpath=” querystring attribute from making their way to

Care must be taken not to log or redisplay unvalidated input from any external source. Improper Error Handling Vulnerability Privacy policy About OWASP Disclaimers Top 10 2007-Information Leakage and Improper Error Handling From OWASP Jump to: navigation, search «««« Main () »»»» Applications can unintentionally leak information about their configuration, Good points. –Matthew Rodatus Jun 9 '11 at 18:20 Can also turn into XSS attacks... –AviD♦ Jun 9 '11 at 23:32 add a comment| up vote 2 down vote

They should not necessarily reveal the methods that were used to determine the error.

PHP has two functions for MySQL that sanitize user input: addslashes (an older approach) and mysql_real_escape_string (the recommended method). Evan - Saturday, September 18, 2010 4:47:32 PM What is the timeline on release of a patch? Hope this helps, Scott ScottGu - Saturday, September 18, 2010 9:10:56 PM @Nitan, >>>>>>>>> Is the httpErrors tag in system.webserver also affected? Improper Error Handling Definition Hope this helps, Scott ScottGu - Saturday, September 18, 2010 10:50:48 PM @Josh, >>>>>>> What is the mechanism which prevent *.config files from being downloaded out of the box?

Here is a list of software which have previously possessed this style of bug: Drupal, Wordpress, Xoops, PostNuke, phpMyFaq, and many others Countermeasures: More recent PHP versions have register_globals set to The most common problem is when detailed internal error messages such as stack traces, database dumps, and error codes are displayed to the user (hacker). That is an obvious vulnerability.) Is it a vulnerability to display exception messages in an error page? More about the author Countermeasures: Avoid connecting to the database as a superuser or as the database owner.

We had to develop the script quickly which is why we haven't been able to build and test separate scripts for different versions. If your app code in a controller is handling an internal exception it is probably ok. more stack exchange communities company blog Stack Exchange Inbox Reputation and Badges sign up log in tour help Tour Start here for a quick overview of the site Help Center Detailed Why do not fix this issue in the ASP.NET framework and release it through Windows Update ASAP?

We believe they actually do make a difference with the attack (and don't just slow the attack down).  A key part of the the attack vector shown is being able to Struts provides the ActionMessages & ActionErrors classes for maintaining a stack of error messages to be reported, which can be used with JSP tags like to display these error Could not find IIS ADSI object. In this case, the error message will expose the table name and column names used in the database.

When accessing a file that the user is not authorized for, it indicates, “access denied”. So it’s not just that we should deliver the same page (content) for all content, we should also deliver the same HTTP status code? But for right now you should not differentiate between 404s and 500s to clients. Rating: Less Critical Previously vulnerable products: Nortel Contivity VPN client, Juniper Netscreen VPN, Cisco IOS [telnet].

It is not only the vendor's responsibility to release a patch as soon as the vulnerability is discovered, but also Website operators deploying software need to keep themselves updated with the Always returning the same HTTP code and error page is one way to help block it. Instead redirect everyone to /Not-Found. Josh Pearce - Saturday, September 18, 2010 9:25:18 PM Hi Scott, Can you give us an estimate on the patch? (hours, days, weeks?) Thanks for the quick responses.

Don’t put any “human” information, which would lead to a level of familiarity and a social engineering exploit. Here is some example exploit code: http://victim_site/clean.php?name_1=scriptcode or http://victim_site/clean.php?name_1=scriptalert(document.cookie); Countermeasures The above code can be edited in the following manner to avoid XSS attacks: Your Name