5

For example, if visiting a webpage you get the response:

Error in exception handler.

This has a high chance the website is using Laravel. Would this class as information disclosure?

I'm guessing not, but thought I'd ask. There's conflicting opinions between our group.

Improve this question
2
  • Yes this is a concern. Imagine if it is a SQL error exception and it prints the SQL statement. Maybe it's not SQL Injectable but it still discloses some of your schema and even the way you write SQL.
    – Dane
    Apr 7, 2016 at 12:05
  • 1
    @Dane I think he means exception messages without any detail, thus generic exception messages.
    – Sjoerd
    Apr 7, 2016 at 12:10

1 Answer 1

Reset to default
3

Should Exceptions be shown to the user?

No.

Displaying exception messages is bad practice. Exceptions should be used to debug the code, they should not be used to display something to the user.

If you use the same mechanism - exceptions - for both tasks, it will be very difficult to separate between them. Eventually, you will either show an exception message with too much information, or you will log an exception with not enough information.

Additionally, exception messages generally do not make for good usability. Why would a user care that there was an error in the exception handler? What are they supposed to do with this information? Most users would not know what an exception handler is, and would be confused by such a message.

Is this information disclosure?

As you noted, you do disclose information through this message (you are using Laravel). And it's also searchable via google, so if for example a new vulnerability in Laravel is found, someone may search google for this error message to find a lot of Laravel installations to attack. This means that with this message, you may theoretically draw attention and attacks towards you.

On the other hand, disclosing used software (without the exact version) is often quite hard to prevent, and sometimes not even desired.

It's really a judgement call if you want to call this information disclosure or not. If you eg take the definition of CWE-200:

An information exposure is the intentional or unintentional disclosure of information to an actor that is not explicitly authorized to have access to that information.

The information either

  1. is regarded as sensitive within the product's own functionality, such as a private message; or

  2. provides information about the product or its environment that could be useful in an attack but is normally not available to the attacker, such as the installation path of a product that is remotely accessible.

So the question is if you think that a user is not authorized to know that you are using Laravel, and if you think that this information is not normally available.

Conclusion

You do leak some - quite minor - information for no good reason, which may have a small impact on security and usability.

You should instead display a useful error message if possible, or a generic error message if not.

Improve this answer
1
  • As a programmer I totally agree. In this instance we were discussing in general unrelated to our projects. It was whether other companies/websites should see this sort of thing as a security risk.
    – BugHunterUK
    Apr 7, 2016 at 14:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .