Unhandled error in web application

The most efficient and secure web applications are made by preventing data leakage. The error messages generated from the server is of greatest use to attackers. The attackers can get information about the servers along with their loopholes. Using this information, the attacker can plan an attack. This server frequently generates error messages.

Example

    <%@ Import Namespace="System.Diagnostics" %>
      <script language="C#" runat="server">
        void Application_Error(Object sender, EventArgs e) {
            String Message = "\n\nURL: http://localhost/" + Request.Path
                              + "\n\nMESSAGE:\n " + Server.GetLastError().Message
                              + "\n\nSTACK TRACE:\n" + Server.GetLastError().StackTrace;
            // Insert into Event Log
            EventLog Log = new EventLog();
            Log.Source = LogName;
            Log.WriteEntry(Message, EventLogEntryType.Error);
          Server.Redirect(Error.htm) // this shall also clear the error
        }
    </script>

  

Impact

The impact include:-

• Data Breach
• Injection attacks
• Blind attacks

Mitigation / Precaution

Beagle recommends the following fixes:-

• Verify that the application does not leak information via error messages.
• Disable or limit detailed error handling.
• Ensure that secure paths that have multiple outcomes return similar or identical error messages.

Written by

Rejah Rehim

Co-founder, Director

Rejah brings more than 12 years of industry experience in Information Technology. He is a fervent security enthusiast and serves as a Project Leader at OWASP Foundation, and Commander (Hon.) at Kerala Police. He has authored two books titled “Effective Python Penetration Testing” and “Python Penetration Testing Cookbook” and is the creator of 9 Mozilla add-ons.