Difference between revisions of "OWASP Periodic Table of Vulnerabilities - Information Leakage"

From OWASP
Jump to: navigation, search
(Posted on behalf of Rajat Bhargava)
 
Line 1: Line 1:
[[OWASP_Periodic_Table_of_Vulnerabilities#Periodic_Table_of_Vulnerabilities|Return to Periodic Table Working View]]
+
[[OWASP_Periodic_Table_of_Vulnerabilities#Periodic_Table_of_Vulnerabilities|Return to Periodic Table Working View]]
 
+
 
+
  
 
== Information Leakage ==
 
== Information Leakage ==
 
 
  
 
=== Root Cause Summary ===
 
=== Root Cause Summary ===
  
Various components in the application, the state of the application and the request/response data can intentionally or unintentionally disclosure information not intended to be disclosed. This information can be in the form of sensitive data or useful information about the application that can be used for targeted attacks.
+
The application discloses sensitive/classified data or useful data about the application that can be used for targeted attacks, even though the developer did not intend to disclose the data.
 
+
 
+
  
 
=== Browser / Standards Solution ===
 
=== Browser / Standards Solution ===
  
 
None
 
None
 
 
  
 
=== Perimeter Solution ===
 
=== Perimeter Solution ===
  
·        Alert, block, or sanitize classified data in responses.
+
* Alert, block, or automatically sanitize classified data in responses.
  
·        Automatically scrub HTML, JavaScript, CSS, and other data formats of comment data.
+
* Automatically scrub HTML, JavaScript, CSS, and other data formats of comment data.
 
+
·        Configure platform to return generic error codes by default and log locally.
+
 
+
·        Disable stack trace to be displayed back, show generic error page instead.  
+
  
 +
* Configure the platform to return generic error codes by default and log locally.
  
 +
* Disable stack traces in production; show a generic error page instead.
  
 
=== Generic Framework Solution ===
 
=== Generic Framework Solution ===
  
·        Provide common error-handling framework and APIs which take two error messages as parameters: one to be displayed to the user and one to be written to logs.
+
* Provide common error-handling framework and APIs which take two error messages as parameters: one to be displayed to the user and one to be written to logs.
  
·        Provide configurable content expiration/caching interface; default to no-cache, no-store.
+
* Provide configurable content expiration/caching interface; default to no-cache, no-store.
  
·        Provide common methods to mask general classified data in responses, example SSN, CC etc.
+
* Provide common methods to mask data in responses based on configurable rules for varying levels of data classification.
  
·        Block classified information to be sent as parameters over GET request.
+
* Block classified information from being sent as URL parameters or logged as part of a GET request.
  
·        Block file paths from being displayed by default.
+
* Block file paths from being displayed by default.
  
 
=== Custom Framework Solution ===
 
=== Custom Framework Solution ===
  
·        Provide common methods to mask data considered sensitive by the application, example email address.
+
None
  
 
=== Custom Code Solution ===
 
=== Custom Code Solution ===
  
·        Don't leak information via error parity mismatches.
+
* Don't leak information via error parity mismatches. For example, a login form should return the same error message regardless of whether the username or password is incorrect, in order to prevent account enumeration.
 
+
·        Only send back data in the response to the client that is needed.
+
 
+
  
 +
* Only send back data in the response to the client that is needed.
  
 
=== Discussion / Controversy ===
 
=== Discussion / Controversy ===
  
 
+
None
  
 
=== References ===
 
=== References ===
  
CWE-200: Information Exposure http://cwe.mitre.org/data/definitions/200.html
+
[http://projects.webappsec.org/w/page/13246936/Information%20Leakage Information Leakage (WASC)]<BR>
 +
[http://cwe.mitre.org/data/definitions/200.html Information Exposure (CWE)]

Revision as of 05:58, 22 July 2013

Return to Periodic Table Working View

Contents

Information Leakage

Root Cause Summary

The application discloses sensitive/classified data or useful data about the application that can be used for targeted attacks, even though the developer did not intend to disclose the data.

Browser / Standards Solution

None

Perimeter Solution

  • Alert, block, or automatically sanitize classified data in responses.
  • Automatically scrub HTML, JavaScript, CSS, and other data formats of comment data.
  • Configure the platform to return generic error codes by default and log locally.
  • Disable stack traces in production; show a generic error page instead.

Generic Framework Solution

  • Provide common error-handling framework and APIs which take two error messages as parameters: one to be displayed to the user and one to be written to logs.
  • Provide configurable content expiration/caching interface; default to no-cache, no-store.
  • Provide common methods to mask data in responses based on configurable rules for varying levels of data classification.
  • Block classified information from being sent as URL parameters or logged as part of a GET request.
  • Block file paths from being displayed by default.

Custom Framework Solution

None

Custom Code Solution

  • Don't leak information via error parity mismatches. For example, a login form should return the same error message regardless of whether the username or password is incorrect, in order to prevent account enumeration.
  • Only send back data in the response to the client that is needed.

Discussion / Controversy

None

References

Information Leakage (WASC)
Information Exposure (CWE)